HEX
Server: LiteSpeed
System: Linux premium321.web-hosting.com 4.18.0-553.50.1.lve.el8.x86_64 #1 SMP Thu Apr 17 19:10:24 UTC 2025 x86_64
User: paksjuts (1314)
PHP: 8.1.33
Disabled: NONE
$ pwd: /home/paksjuts/
Upload Files
File: /home/paksjuts/scanreport-paksjuts-Oct_20_2025_08h03m.txt
----------- SCAN REPORT -----------
TimeStamp: Mon, 20 Oct 2025 08:03:52 -0400
(/usr/sbin/cxs --background --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --noprobability --qoptions Mv --report /home/paksjuts/scanreport-paksjuts-Oct_20_2025_08h03m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user paksjuts --virusscan --vmrssmax 2000000 --waitscan 0 --xtra /etc/cxs/cxs.xtra.manual)


Scanning /home/paksjuts:

'/home/paksjuts/.nc_plugin/hidden'
# World writeable directory

'/home/paksjuts/apkhoop.com/.tmb'
# World writeable directory

'/home/paksjuts/apkhoop.com/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cgi-bin/iTcGzEhrResXPFA.tif'
# Suspicious image file (hidden script file)

'/home/paksjuts/apkhoop.com/wp-admin/css/colors/midnight/midnight/midnight/psSlTNqMixZz.tif'
# Suspicious image file (hidden script file)

'/home/paksjuts/apkhoop.com/wp-admin/css/colors/ocean/ocean/ocean/tiff_68f48f6931052.zip'
# (compressed file: b_68f48f6931052.tmp [depth: 1]) Known exploit = [Fingerprint Match (fp)] [PHP Exploit [P2195]]

'/home/paksjuts/apkhoop.com/wp-content/plugins/akismet/_inc/img/logo-soornsr.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/paksjuts/apkhoop.com/wp-content/plugins/elementor/modules/ai/feature-intro/feature-intro/ZeFrnVbC.jpg'
# Suspicious image file (hidden script file)

'/home/paksjuts/apkhoop.com/wp-content/plugins/elementor/modules/element-cache/element-cache/KBqFPajxzG.jpg'
# Suspicious image file (hidden script file)

'/home/paksjuts/apkhoop.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/DH/DH/he.png'
# Suspicious image file (hidden script file)

'/home/paksjuts/apkhoop.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/apkhoop.com/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/apkhoop.com/wp-content/plugins/pojo-accessibility/modules/legacy/components/upgrade.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/apkhoop.com/wp-content/plugins/wp-file-manager/css/css/tiff_68ef6cd55cd79.zip'
# (compressed file: b_68ef6cd55cd79.tmp [depth: 1]) Known exploit = [Fingerprint Match (fp)] [PHP Exploit [P2202]]

'/home/paksjuts/apkhoop.com/wp-content/plugins/wp-file-manager/lib/codemirror/mode/clike/index.html'
# Suspicious file type [application/x-c]

'/home/paksjuts/apkhoop.com/wp-includes/Text/Diff/Engine/soornsr.ttf'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/apkhoop.com/wp-includes/blocks/cover/style-rel.css'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/apkhoop.com/wp-includes/images/w-fbbeafe.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/paksjuts/apkhoop.com/wp-includes/images/wpspin-1x.gif'
# Suspicious image file (hidden script file)

'/home/paksjuts/apkhoop.com/wp-includes/images/xit-3x.gif'
# Suspicious image file (hidden script file)

'/home/paksjuts/apkhoop.com/wp-includes/images/media/fbbeafe.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/paksjuts/mail/new/1752483285.M931226P3671701.premium321.web-hosting.com,S=29328,W=29924'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1752975579.M164424P504256.premium321.web-hosting.com,S=66051,W=67345'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754026284.M717576P3416234.premium321.web-hosting.com,S=43018,W=43928'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754026284.M75099P3416234.premium321.web-hosting.com,S=42971,W=43881'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754112744.M25244P3764224.premium321.web-hosting.com,S=17478,W=17840'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754112744.M349387P3764224.premium321.web-hosting.com,S=17522,W=17884'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754794197.M503670P1500978.premium321.web-hosting.com,S=32890,W=33576'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754794198.M99496P1500978.premium321.web-hosting.com,S=32940,W=33626'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754799047.M410232P1740387.premium321.web-hosting.com,S=35063,W=35831'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754799049.M637438P1740387.premium321.web-hosting.com,S=35103,W=35871'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754887406.M175166P2477074.premium321.web-hosting.com,S=27984,W=28611'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1754887408.M373656P2477074.premium321.web-hosting.com,S=28019,W=28646'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755180917.M425524P2705159.premium321.web-hosting.com,S=30097,W=30748'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755180920.M519892P2705159.premium321.web-hosting.com,S=30148,W=30799'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755492364.M209042P1171287.premium321.web-hosting.com,S=31866,W=32583'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755492365.M916772P1171287.premium321.web-hosting.com,S=31907,W=32624'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755515502.M651610P2617526.premium321.web-hosting.com,S=67542,W=68751'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755515503.M102420P2617526.premium321.web-hosting.com,S=67578,W=68787'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755573574.M834839P1801330.premium321.web-hosting.com,S=27497,W=28119'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1755573575.M245723P1801330.premium321.web-hosting.com,S=27533,W=28155'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1755587088.M688771P2389725.premium321.web-hosting.com,S=35036,W=35589'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755587090.M484674P2389725.premium321.web-hosting.com,S=35079,W=35632'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755619120.M555152P4162571.premium321.web-hosting.com,S=41554,W=42407'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755619124.M910553P4162571.premium321.web-hosting.com,S=41597,W=42450'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755632669.M777971P708624.premium321.web-hosting.com,S=42475,W=43328'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755632671.M467459P708624.premium321.web-hosting.com,S=42523,W=43376'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755702674.M271143P373875.premium321.web-hosting.com,S=49670,W=50627'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1755702675.M919374P373875.premium321.web-hosting.com,S=49717,W=50674'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1755706480.M118843P373875.premium321.web-hosting.com,S=50164,W=51139'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755706483.M826149P373875.premium321.web-hosting.com,S=50206,W=51181'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755762809.M47442P4016029.premium321.web-hosting.com,S=43561,W=44515'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755762811.M241881P4016029.premium321.web-hosting.com,S=43612,W=44566'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755779401.M608355P533921.premium321.web-hosting.com,S=36487,W=37289'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755779402.M74652P533921.premium321.web-hosting.com,S=36534,W=37336'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1755827853.M100738P3354873.premium321.web-hosting.com,S=31619,W=32274'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1755827855.M305871P3354873.premium321.web-hosting.com,S=31667,W=32322'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1756039889.M639023P3889485.premium321.web-hosting.com,S=48588,W=49614'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756039891.M966732P3889485.premium321.web-hosting.com,S=48634,W=49660'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756122920.M791585P4045046.premium321.web-hosting.com,S=35027,W=35824'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1756122921.M368796P4045046.premium321.web-hosting.com,S=35079,W=35876'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1756377320.M115239P1197679.premium321.web-hosting.com,S=34249,W=35007'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756377322.M18958P1197679.premium321.web-hosting.com,S=34298,W=35056'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756379091.M722467P1343389.premium321.web-hosting.com,S=60736,W=62055'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756379092.M617076P1343389.premium321.web-hosting.com,S=60783,W=62102'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756603704.M931373P937845.premium321.web-hosting.com,S=48548,W=49508'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756603705.M498583P937845.premium321.web-hosting.com,S=48597,W=49557'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756619277.M541186P3757726.premium321.web-hosting.com,S=49461,W=50430'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756619277.M944327P3757726.premium321.web-hosting.com,S=49501,W=50470'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756807992.M352446P1624095.premium321.web-hosting.com,S=41287,W=42158'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756807992.M814101P1679942.premium321.web-hosting.com,S=41330,W=42201'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756889906.M585036P1955364.premium321.web-hosting.com,S=31660,W=32357'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1756889910.M846089P1955364.premium321.web-hosting.com,S=31713,W=32410'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757093426.M590531P890163.premium321.web-hosting.com,S=42219,W=43059'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757093426.M988911P890163.premium321.web-hosting.com,S=42272,W=43112'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757151625.M294701P90253.premium321.web-hosting.com,S=40269,W=41158'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1757151625.M951625P90253.premium321.web-hosting.com,S=40309,W=41198'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1757191256.M643872P2303539.premium321.web-hosting.com,S=4105,W=4207'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1757305907.M865427P2852264.premium321.web-hosting.com,S=37710,W=38513'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757305909.M575622P2852264.premium321.web-hosting.com,S=37755,W=38558'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757467685.M969620P508782.premium321.web-hosting.com,S=59394,W=60525'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757467687.M655052P508782.premium321.web-hosting.com,S=59446,W=60577'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757471071.M888978P508782.premium321.web-hosting.com,S=32254,W=32906'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757471073.M558570P508782.premium321.web-hosting.com,S=32303,W=32955'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757480201.M532970P1254904.premium321.web-hosting.com,S=55952,W=56875'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757480202.M337944P1254904.premium321.web-hosting.com,S=55997,W=56920'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757495961.M976547P2215450.premium321.web-hosting.com,S=31856,W=32574'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1757495962.M751137P2215450.premium321.web-hosting.com,S=31908,W=32626'
# ClamAV detected virus = [YARA.telnet_cgi.UNOFFICIAL]

'/home/paksjuts/mail/new/1757517118.M730113P3690082.premium321.web-hosting.com,S=37573,W=38398'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757517120.M469322P3690082.premium321.web-hosting.com,S=37625,W=38450'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757568339.M305267P2662205.premium321.web-hosting.com,S=51933,W=52876'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757568339.M777685P2662205.premium321.web-hosting.com,S=51978,W=52921'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757665417.M640636P197486.premium321.web-hosting.com,S=47778,W=48790'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/mail/new/1757665419.M780658P197486.premium321.web-hosting.com,S=47825,W=48837'
# ClamAV detected virus = [YARA.hacked_domains.UNOFFICIAL]

'/home/paksjuts/public_html/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/wp-seopress/inc/admin/admin.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/wp-seopress/inc/admin/admin-bar/admin-bar.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/wp-seopress/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/public_html/wp-content/plugins/wp-seopress/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/images/images/images/images/wMUWLslKCuSvBHpVgXr.jpeg'
# Suspicious image file (hidden script file)

'/home/paksjuts/pyis.xyz/wp-admin/css/colors/light/light/tif_68f08a4a04779.zip'
# (compressed file: b_68f08a4a04779.tmp [depth: 1]) Known exploit = [Fingerprint Match (fp)] [PHP Exploit [P2195]]

'/home/paksjuts/pyis.xyz/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/plugins/ad-inserter/includes/google-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/plugins/ad-inserter/includes/google-api/vendor/psr/log/Psr/Log/Test/Test/ghnNVbBMfZPxKWplcFa.gif'
# Suspicious image file (hidden script file)

'/home/paksjuts/pyis.xyz/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/plugins/ad-inserter/includes/google-api-8/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/plugins/fast-indexing-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/plugins/fast-indexing-api/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571k1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/plugins/google-site-kit/third-party/phpseclib/phpseclib/phpseclib/Crypt/EC/Curves/sect571r1.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-content/themes/astra/admin/includes/class-astra-menu.php'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-includes/Text/Diff/Engine/rpsopqpoqqoqpqpo.ttf'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-includes/blocks/cover/style-rel.css'
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-includes/blocks/query-total/query-total/3gp_68f08a473d106.zip'
# (compressed file: b_68f08a473d106.tmp [depth: 1]) Known exploit = [Fingerprint Match (fp)] [PHP Exploit [P2202]]

'/home/paksjuts/pyis.xyz/wp-includes/images/w-ecfbcdcbddbdcdcb.gif'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

'/home/paksjuts/pyis.xyz/wp-includes/images/wpspin-1x.gif'
# Suspicious image file (hidden script file)

'/home/paksjuts/pyis.xyz/wp-includes/images/xit-3x.gif'
# Suspicious image file (hidden script file)

'/home/paksjuts/pyis.xyz/wp-includes/images/media/ecfbcdcbddbdcdcb.png'
# Suspicious image file (hidden script file)
# Universal decode regex match = [universal decoder]

----------- SCAN SUMMARY -----------
Scanned directories: 10702
Scanned files: 80370
Ignored items: 119
Suspicious matches: 127
Viruses found: 73
Fingerprint matches: 4
Data scanned: 1369.60 MB
Scan peak memory: 391040 kB
Scan time/item: 0.027 sec
Scan time: 2421.465 sec
@ Telegram