OK, what is suspicious below? thanks all for your help!
root@GL-MT300N-V2:~# du -ha /etc/ | sort | egrep "\..K"
1.0K /etc/config/ddns
1.0K /etc/config/luci
1.0K /etc/config/luci-opkg
1.0K /etc/config/nodogsplash
1.0K /etc/config/shadowsocks
1.0K /etc/config/ssids
1.0K /etc/config/ucitrack
1.0K /etc/config/ucitrack-opkg
1.0K /etc/config/uhttpd
1.0K /etc/config/wireless
1.0K /etc/dropbear
1.0K /etc/dropbear/dropbear_rsa_host_key
1.0K /etc/forward
1.0K /etc/gcom/runcommand.gcom
1.0K /etc/gcom/setpin.gcom
1.0K /etc/hotplug.d/iface/25-glqos
1.0K /etc/hotplug.d/net/30-tethering
1.0K /etc/hotplug.d/tty
1.0K /etc/hotplug.d/tty/30-3g
1.0K /etc/hotplug.d/usb/20-usbmuxd
1.0K /etc/hotplug.d/usbmisc
1.0K /etc/hotplug.d/usbmisc/00_wwan.sh
1.0K /etc/init.d/cron
1.0K /etc/init.d/ddns
1.0K /etc/init.d/firewall
1.0K /etc/init.d/gl_monitor
1.0K /etc/init.d/gpio_switch
1.0K /etc/init.d/lighttpd
1.0K /etc/init.d/set-irq-affinity
1.0K /etc/init.d/stubby
1.0K /etc/init.d/sysfixtime
1.0K /etc/init.d/system
1.0K /etc/lighttpd/conf.d/30-cgi.conf
1.0K /etc/lighttpd/conf.d/30-expire.conf
1.0K /etc/mwan3.user
1.0K /etc/openvpn/ovpn4/cert/202006111436-Wdc.key
1.0K /etc/preinit
1.0K /etc/rc.button/rfkill
1.0K /etc/rc.local
1.0K /etc/samba
1.0K /etc/samba/smb.conf.template
1.0K /etc/ssl/certs/AffirmTrust_Premium_ECC.crt
1.0K /etc/ssl/certs/Amazon_Root_CA_3.crt
1.0K /etc/ssl/certs/Amazon_Root_CA_4.crt
1.0K /etc/ssl/certs/COMODO_ECC_Certification_Authority.crt
1.0K /etc/ssl/certs/DigiCert_Assured_ID_Root_G3.crt
1.0K /etc/ssl/certs/DigiCert_Global_Root_G3.crt
1.0K /etc/ssl/certs/GTS_Root_R3.crt
1.0K /etc/ssl/certs/GTS_Root_R4.crt
1.0K /etc/ssl/certs/GlobalSign_ECC_Root_CA_-<em>R4.crt
1.0K /etc/ssl/certs/GlobalSign_ECC_Root_CA</em>-<em>R5.crt
1.0K /etc/ssl/certs/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt
1.0K /etc/ssl/certs/OISTE_WISeKey_Global_Root_GC_CA.crt
1.0K /etc/ssl/certs/SSL.com_EV_Root_Certification_Authority_ECC.crt
1.0K /etc/ssl/certs/SSL.com_Root_Certification_Authority_ECC.crt
1.0K /etc/ssl/certs/USERTrust_ECC_Certification_Authority.crt
1.0K /etc/ssl/certs/emSign_ECC_Root_CA</em>-<em>C3.crt
1.0K /etc/ssl/certs/emSign_ECC_Root_CA</em>-<em>G3.crt
1.0K /etc/stubby/stubby_nextdns.yml
1.0K /etc/stubby/stubby_nextdns_default.yml
1.0K /etc/sysctl.conf
1.0K /etc/sysctl.d/10-default.conf
1.0K /etc/uhttpd.crt
1.5K /etc/board.d/03_gpio_switches
1.5K /etc/board.json
1.5K /etc/config/dhcp
1.5K /etc/config/dnscrypt-proxy
1.5K /etc/config/glconfig
1.5K /etc/config/network
1.5K /etc/config/qos
1.5K /etc/config/system
1.5K /etc/diag.sh
1.5K /etc/dnsmasq.conf
1.5K /etc/ethertypes
1.5K /etc/hotplug.d/net/20-smp-tune
1.5K /etc/hotplug.json
1.5K /etc/init.d/boot
1.5K /etc/init.d/done
1.5K /etc/init.d/gl_bigdata
1.5K /etc/init.d/sysctl
1.5K /etc/init.d/ucitrack
1.5K /etc/iproute2
1.5K /etc/lighttpd/conf.d/30-proxy.conf
1.5K /etc/nodogsplash/htdocs/images/favicon.ico
1.5K /etc/nodogsplash/htdocs/infoskel.html
1.5K /etc/openvpn/update-resolv-conf
1.5K /etc/profile
1.5K /etc/rc.d
1.5K /etc/ssl/certs/AffirmTrust_Commercial.crt
1.5K /etc/ssl/certs/AffirmTrust_Networking.crt
1.5K /etc/ssl/certs/Amazon_Root_CA_1.crt
1.5K /etc/ssl/certs/Atos_TrustedRoot_2011.crt
1.5K /etc/ssl/certs/Baltimore_CyberTrust_Root.crt
1.5K /etc/ssl/certs/COMODO_Certification_Authority.crt
1.5K /etc/ssl/certs/Certigna.crt
1.5K /etc/ssl/certs/Certum_Trusted_Network_CA.crt
1.5K /etc/ssl/certs/Comodo_AAA_Services_root.crt
1.5K /etc/ssl/certs/Cybertrust_Global_Root.crt
1.5K /etc/ssl/certs/D-TRUST_Root_Class_3_CA_2_2009.crt
1.5K /etc/ssl/certs/DST_Root_CA_X3.crt
1.5K /etc/ssl/certs/DigiCert_Assured_ID_Root_CA.crt
1.5K /etc/ssl/certs/DigiCert_Assured_ID_Root_G2.crt
1.5K /etc/ssl/certs/DigiCert_Global_Root_CA.crt
1.5K /etc/ssl/certs/DigiCert_Global_Root_G2.crt
1.5K /etc/ssl/certs/DigiCert_High_Assurance_EV_Root_CA.crt
1.5K /etc/ssl/certs/EE_Certification_Centre_Root_CA.crt
1.5K /etc/ssl/certs/Entrust.net_Premium_2048_Secure_Server_CA.crt
1.5K /etc/ssl/certs/Entrust_Root_Certification_Authority</em>-<em>EC1.crt
1.5K /etc/ssl/certs/Entrust_Root_Certification_Authority</em>-<em>G2.crt
1.5K /etc/ssl/certs/GlobalSign_Root_CA.crt
1.5K /etc/ssl/certs/GlobalSign_Root_CA</em>-<em>R2.crt
1.5K /etc/ssl/certs/GlobalSign_Root_CA</em>-<em>R3.crt
1.5K /etc/ssl/certs/Go_Daddy_Class_2_CA.crt
1.5K /etc/ssl/certs/Go_Daddy_Root_Certificate_Authority</em>-<em>G2.crt
1.5K /etc/ssl/certs/Hellenic_Academic_and_Research_Institutions_RootCA_2011.crt
1.5K /etc/ssl/certs/Hongkong_Post_Root_CA_1.crt
1.5K /etc/ssl/certs/Microsec_e-Szigno_Root_CA_2009.crt
1.5K /etc/ssl/certs/NetLock_Arany</em>=Class_Gold=<em>FХtanУКsУtvУЁny.crt
1.5K /etc/ssl/certs/Network_Solutions_Certificate_Authority.crt
1.5K /etc/ssl/certs/OISTE_WISeKey_Global_Root_GA_CA.crt
1.5K /etc/ssl/certs/OISTE_WISeKey_Global_Root_GB_CA.crt
1.5K /etc/ssl/certs/SZAFIR_ROOT_CA2.crt
1.5K /etc/ssl/certs/SecureSign_RootCA11.crt
1.5K /etc/ssl/certs/SecureTrust_CA.crt
1.5K /etc/ssl/certs/Secure_Global_CA.crt
1.5K /etc/ssl/certs/Security_Communication_RootCA2.crt
1.5K /etc/ssl/certs/Security_Communication_Root_CA.crt
1.5K /etc/ssl/certs/Sonera_Class_2_Root_CA.crt
1.5K /etc/ssl/certs/Starfield_Class_2_CA.crt
1.5K /etc/ssl/certs/Starfield_Root_Certificate_Authority</em>-<em>G2.crt
1.5K /etc/ssl/certs/Starfield_Services_Root_Certificate_Authority</em>-<em>G2.crt
1.5K /etc/ssl/certs/T-TeleSec_GlobalRoot_Class_2.crt
1.5K /etc/ssl/certs/T-TeleSec_GlobalRoot_Class_3.crt
1.5K /etc/ssl/certs/TWCA_Root_Certification_Authority.crt
1.5K /etc/ssl/certs/TrustCor_ECA-1.crt
1.5K /etc/ssl/certs/TrustCor_RootCert_CA-1.crt
1.5K /etc/ssl/certs/Trustis_FPS_Root_CA.crt
1.5K /etc/ssl/certs/Verisign_Class_3_Public_Primary_Certification_Authority</em>-<em>G3.crt
1.5K /etc/ssl/certs/XRamp_Global_CA_Root.crt
1.5K /etc/ssl/certs/certSIGN_ROOT_CA.crt
1.5K /etc/ssl/certs/emSign_Root_CA</em>-<em>C1.crt
1.5K /etc/ssl/certs/emSign_Root_CA</em>-<em>G1.crt
1.5K /etc/stubby/stubby.yml
10.0K /etc/init.d/gl_ipv6
10.0K /etc/opkg
11.5K /etc/init.d/nodogsplash
12.5K /etc/ddns
12.5K /etc/ssl/openssl.cnf
13.5K /etc/config/openvpn
14.5K /etc/board.d/02_network
15.5K /etc/board.d/01_leds
16.5K /etc/hotplug.d/iface
18.0K /etc/lighttpd
19.0K /etc/stubby/stubby.yml.default
194.0K /etc/ssl/certs/ca-certificates.crt
2.0K /etc/chatscripts
2.0K /etc/config/mwan3
2.0K /etc/hotplug.d/firmware
2.0K /etc/hotplug.d/firmware/10-rt2x00-eeprom
2.0K /etc/init.d/qosswitch
2.0K /etc/init.d/rtty
2.0K /etc/lighttpd/lighttpd.conf
2.0K /etc/openvpn/ovpn4/cert/202006111436-ca.crt
2.0K /etc/rc.button/wps
2.0K /etc/ssl/certs/AC_RAIZ_FNMT-RCM.crt
2.0K /etc/ssl/certs/AffirmTrust_Premium.crt
2.0K /etc/ssl/certs/Amazon_Root_CA_2.crt
2.0K /etc/ssl/certs/Buypass_Class_2_Root_CA.crt
2.0K /etc/ssl/certs/Buypass_Class_3_Root_CA.crt
2.0K /etc/ssl/certs/CA_Disig_Root_R2.crt
2.0K /etc/ssl/certs/CFCA_EV_ROOT.crt
2.0K /etc/ssl/certs/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
2.0K /etc/ssl/certs/DigiCert_Trusted_Root_G4.crt
2.0K /etc/ssl/certs/EC-ACC.crt
2.0K /etc/ssl/certs/Entrust_Root_Certification_Authority.crt
2.0K /etc/ssl/certs/GDCA_TrustAUTH_R5_ROOT.crt
2.0K /etc/ssl/certs/GTS_Root_R1.crt
2.0K /etc/ssl/certs/GTS_Root_R2.crt
2.0K /etc/ssl/certs/GeoTrust_Universal_CA_2.crt
2.0K /etc/ssl/certs/GlobalSign_Root_CA</em>-<em>R6.crt
2.0K /etc/ssl/certs/ISRG_Root_X1.crt
2.0K /etc/ssl/certs/IdenTrust_Commercial_Root_CA_1.crt
2.0K /etc/ssl/certs/IdenTrust_Public_Sector_Root_CA_1.crt
2.0K /etc/ssl/certs/QuoVadis_Root_CA_1_G3.crt
2.0K /etc/ssl/certs/QuoVadis_Root_CA_2.crt
2.0K /etc/ssl/certs/QuoVadis_Root_CA_2_G3.crt
2.0K /etc/ssl/certs/QuoVadis_Root_CA_3_G3.crt
2.0K /etc/ssl/certs/Staat_der_Nederlanden_EV_Root_CA.crt
2.0K /etc/ssl/certs/Staat_der_Nederlanden_Root_CA</em>-<em>G3.crt
2.0K /etc/ssl/certs/SwissSign_Gold_CA</em>-<em>G2.crt
2.0K /etc/ssl/certs/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi</em>-<em>Surum_1.crt
2.0K /etc/ssl/certs/TWCA_Global_Root_CA.crt
2.0K /etc/ssl/certs/Taiwan_GRCA.crt
2.0K /etc/ssl/certs/TeliaSonera_Root_CA_v1.crt
2.0K /etc/ssl/certs/UCA_Extended_Validation_Root.crt
2.0K /etc/ssl/certs/UCA_Global_G2_Root.crt
2.0K /etc/ssl/certs/ePKI_Root_Certification_Authority.crt
2.0K /etc/tertf/tertfinfo_bak
2.0K /etc/uhttpd.key
2.5K /etc/firewall.user
2.5K /etc/gcom/ncm.json
2.5K /etc/hotplug.d/block/10-mount
2.5K /etc/hotplug.d/usb
2.5K /etc/init.d/gl_tertf
2.5K /etc/init.d/log
2.5K /etc/init.d/relayd
2.5K /etc/init.d/sysntpd
2.5K /etc/nodogsplash/htdocs/images/splash.jpg
2.5K /etc/protocols
2.5K /etc/rc.common
2.5K /etc/ssl/certs/Actalis_Authentication_Root_CA.crt
2.5K /etc/ssl/certs/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt
2.5K /etc/ssl/certs/COMODO_RSA_Certification_Authority.crt
2.5K /etc/ssl/certs/Certigna_Root_CA.crt
2.5K /etc/ssl/certs/Certum_Trusted_Network_CA_2.crt
2.5K /etc/ssl/certs/E-Tugra_Certification_Authority.crt
2.5K /etc/ssl/certs/Entrust_Root_Certification_Authority</em>-<em>G4.crt
2.5K /etc/ssl/certs/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt
2.5K /etc/ssl/certs/Hongkong_Post_Root_CA_3.crt
2.5K /etc/ssl/certs/Izenpe.com.crt
2.5K /etc/ssl/certs/LuxTrust_Global_Root_2.crt
2.5K /etc/ssl/certs/QuoVadis_Root_CA.crt
2.5K /etc/ssl/certs/QuoVadis_Root_CA_3.crt
2.5K /etc/ssl/certs/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt
2.5K /etc/ssl/certs/SSL.com_Root_Certification_Authority_RSA.crt
2.5K /etc/ssl/certs/Staat_der_Nederlanden_Root_CA</em>-<em>G2.crt
2.5K /etc/ssl/certs/SwissSign_Silver_CA</em>-<em>G2.crt
2.5K /etc/ssl/certs/TrustCor_RootCert_CA-2.crt
2.5K /etc/ssl/certs/USERTrust_RSA_Certification_Authority.crt
2.5K /etc/sysctl.d
21.0K /etc/init.d/wireguard
21.5K /etc/init.d/gl_init
22.5K /etc/stubby
231.5K /etc/init.d
27.5K /etc/init.d/gl_route_policy
29.5K /etc/init.d/dnsmasq
3.0K /etc/hotplug.d/block/50-samba
3.0K /etc/hotplug.d/iface/15-mwan3
3.0K /etc/init.d/network
3.0K /etc/lighttpd/mime.conf
3.0K /etc/openvpn/ovpn4/cert
3.0K /etc/ssl/certs/ACCVRAIZ1.crt
3.0K /etc/ssl/certs/Chambers_of_Commerce_Root</em>-<em>2008.crt
3.0K /etc/ssl/certs/Global_Chambersign_Root</em>-_2008.crt
3.5K /etc/init.d/glfw
3.5K /etc/lighttpd/server.pem
3.5K /etc/services
32.0K /etc/board.d
34.0K /etc/hotplug.d
4.0K /etc/ddns/services_ipv6
4.0K /etc/hotplug.d/net
4.0K /etc/init.d/led
4.0K /etc/wireless
4.0K /etc/wireless/mt7628
4.0K /etc/wireless/mt7628/mt7628.dat
4.5K /etc/config/uhttpd-opkg
4.5K /etc/firewall.nat6
4.5K /etc/init.d/generate_channel_list
4.5K /etc/init.d/vpn-service
4.5K /etc/lighttpd/conf.d/30-fastcgi.conf
41.0K /etc/modules.d
414.5K /etc/ssl/certs
427.0K /etc/ssl
5.0K /etc/config/firewall
5.0K /etc/init.d/openvpn
5.5K /etc/hotplug.d/block
5.5K /etc/init.d/dnscrypt-proxy
5.5K /etc/init.d/uhttpd
5.5K /etc/rc.button
5.5K /etc/vpn.user
52.0K /etc/usb-mode.json
54.0K /etc/config
6.0K /etc/init.d/dropbear
6.0K /etc/init.d/gl_s2s
6.5K /etc/init.d/wireguard_server
61.0K /etc/openvpn/ovpn4
63.0K /etc/openvpn
7.0K /etc/nodogsplash/htdocs/splash.html
7.5K /etc/init.d/glqos
77.5K /etc/nodogsplash/htdocs/images/portal_login.png
8.5K /etc/ddns/services
8.5K /etc/gcom
81.5K /etc/nodogsplash/htdocs/images
9.0K /etc/hotplug.d/iface/21-mirrir_route
9.0K /etc/opkg/keys
9.5K /etc/init.d/startvpn
9.5K /etc/lighttpd/conf.d
90.0K /etc/nodogsplash
90.0K /etc/nodogsplash/htdocs
928.0K /etc/tertf/mac_vendor.db
930.0K /etc/tertf
root@GL-MT300N-V2:~#